Threats & Adversaries · Ransomware
KongTuke’s stealth foothold now looks brokered The real shift is that Mistic is now being treated as a handoffable access package, not just a backdoor name. It is tied to Woodgnat/KongTuke and shown deployed with ModeloRAT, which points to durable, low-visibility access that can be sold or reused before ransomware ever starts.
Symantec and Carbon Black say the activity has hit insurance, education, IT, and professional services since April 2026. The backdoor runs in memory, can delete itself, and was used alongside a Python RAT, with reporting also tying KongTuke to earlier ClickFix-style intrusions that trick users into running commands under a false security prompt.
That changes cleanup from 'remove the malware' to 'assume access may already be established and brokered onward.' Even if no file is left behind, the foothold can still be alive in memory or already passed to another crew.
5 sources · Jun 25
Timeline Sources Jun 25 The Hacker News
New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns
Symantec and Carbon Black link Mistic backdoor attacks to KongTuke, using ClickFix lures and in-memory execution for stealthy access.
original Jun 25 Help Net Security
Stealthy new backdoor surfaces in attacks on multiple sectors - Help Net Security
A relatively new backdoor called Mistic appears to be linked to Woodgnat and has been used in attacks targeting multiple sectors.
original Jun 24 CSO Online
Be on the lookout for Mistic, a new backdoor used by ransomware broker
The malware program has been deployed across multiple sectors since April, helping to provide initial access sold to ransomware gangs.
original Part of the PlainSec briefing for 2026-06-25
Every edition of this story: KongTuke’s stealth foothold now looks brokered
More from today Threats & Adversaries · Ransomware
KongTuke’s stealth foothold now looks brokered The real shift is that Mistic is now being treated as a handoffable access package, not just a backdoor name. It is tied to Woodgnat/KongTuke and shown deployed with ModeloRAT, which points to durable, low-visibility access that can be sold or reused before ransomware ever starts.
Symantec and Carbon Black say the activity has hit insurance, education, IT, and professional services since April 2026. The backdoor runs in memory, can delete itself, and was used alongside a Python RAT, with reporting also tying KongTuke to earlier ClickFix-style intrusions that trick users into running commands under a false security prompt.
That changes cleanup from 'remove the malware' to 'assume access may already be established and brokered onward.' Even if no file is left behind, the foothold can still be alive in memory or already passed to another crew.
5 sources · Jun 25
Timeline Sources Jun 25 The Hacker News
New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns
Symantec and Carbon Black link Mistic backdoor attacks to KongTuke, using ClickFix lures and in-memory execution for stealthy access.
original Jun 25 Help Net Security
Stealthy new backdoor surfaces in attacks on multiple sectors - Help Net Security
A relatively new backdoor called Mistic appears to be linked to Woodgnat and has been used in attacks targeting multiple sectors.
original Jun 24 CSO Online
Be on the lookout for Mistic, a new backdoor used by ransomware broker
The malware program has been deployed across multiple sectors since April, helping to provide initial access sold to ransomware gangs.
original Part of the PlainSec briefing for 2026-06-25
Every edition of this story: KongTuke’s stealth foothold now looks brokered
More from today