Woodgnat Broker Uses Mistic and MLTBackdoor Malware

The initial access broker (IAB) Woodgnat, also known as KongTuke, has intensified operations as of mid-2026, deploying two new remote access trojans (RATs): Backdoor.Mistic (also tracked as MLTBackdoor) and ModeloRAT. Woodgnat functions as a critical node in the ransomware supply chain, establishing persistent network footholds and selling them to prominent ransomware families including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. The group's targeting is opportunistic, frequently hitting the education, IT services, insurance, and professional services sectors.

The attack chain typically begins with social engineering via Microsoft Teams helpdesk lures or compromised WordPress sites utilizing 'ClickFix,' 'FileFix,' and 'CrashFix' deception techniques. These lures trick users into executing PowerShell commands that facilitate the deployment of memory-resident backdoors. Woodgnat demonstrates high operational maturity by profiling infected machines for their resale value, utilizing custom obfuscation methods like Mixed Boolean-Arithmetic (MBA), and maintaining persistence through DLL sideloading and registry manipulation.

This activity represents a significant threat to enterprise environments, as Woodgnat’s ability to bypass traditional security controls through legitimate platforms (Teams, WordPress) and memory-resident tools reduces the dwell time required for ransomware deployment. Organizations should treat these IAB activities as immediate precursors to full-scale ransomware incidents.