Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker

Symantec researchers describe Backdoor.Mistic, a stealthy Windows backdoor first observed in April 2026 that is sideloaded via a legitimate executable and runs payloads entirely in memory with a built-in kill switch; the report links Mistic to the financially motivated initial-access group Woodgnat (aka KongTuke), notes ties to ModeloRAT and observed ransomware delivery (Qilin), details attacker TTPs (paste-and-run social engineering, sideloading, in-memory execution), and provides extensive file and network IOCs for detection and mitigation.