Mistic Backdoor Blends With Microsoft Endpoint Security Tooling to Evade Detection

A new and stealthy backdoor named Mistic has been quietly targeting corporate networks since April 2026, disguising itself using the names and appearance of legitimate Microsoft endpoint security components.

This clever camouflage helps it avoid detection, allowing attackers to maintain a persistent, low-profile foothold inside compromised environments. Security teams across multiple industries are now on alert as incidents continue to emerge.

Mistic has hit organizations in insurance, education, information technology, and professional services. The attacks are opportunistic in nature, meaning the group casts a wide net and evaluates which compromised networks are worth selling access to.

That access is then offered to ransomware affiliates and other criminal groups who pay for a ready-made entry point into enterprise systems.

Analysts from Symantec identified the threat and connected it to a financially motivated cybercrime group tracked as Woodgnat, also known as KongTuke.

According to Symantec report shared with Cyber Security News (CSN), the Symantec Threat Hunter Team found Mistic deployed alongside ModeloRAT, a remote access tool tied to attacks involving Qilin, Akira, Rhysida, Black Basta, Interlock, and 8Base.

Mistic was first publicly documented by Zscaler, which tracks it as MLTBackdoor. Symantec’s investigation went deeper, tying the backdoor more firmly to Woodgnat’s expanding toolkit and confirming its role in a broader criminal supply chain.

The group’s goal is not to launch the final attack itself but to sell high-value access to others who will.

What makes Mistic especially dangerous is how well it hides. It runs entirely in memory with no files written to disk, and it carries a built-in kill switch that lets it erase itself when no longer needed.

These traits make it extremely difficult to detect and allow attackers to operate quietly inside a network for extended periods.

Mistic reaches its target through a technique known as DLL sideloading, where a legitimate executable is manipulated into loading a malicious file.

In investigated attacks, a legitimate Microsoft file called MpExtMs.exe was used to sideload a malicious DLL named EndpointDlp.dll, a name directly associated with Microsoft endpoint security tooling.

This naming choice helps the backdoor appear like trusted software running in the background.

A loader called version.dll sits in the middle of this process. It hooks two Windows functions, GetModuleFileNameW and LoadLibraryW, directing execution toward the malicious DLL while keeping normal appearances intact.

A separate .NET DLL was also deployed as a credential stealer, displaying a fake login screen to harvest user passwords from unsuspecting victims.

Beyond hiding well, Mistic is highly capable. It can upload and download files, move or delete data, create folders, run remote code in memory, and adjust its check-in frequency with the attacker’s command-and-control server. This gives operators strong control over any network they manage to infiltrate.

Woodgnat’s Expanding Attack Playbook

Woodgnat has been active since at least May 2024 and has steadily refined its attack methods. The group compromises WordPress sites and injects JavaScript to profile visitors before pushing social engineering lures that trick users into running malicious commands.

These lures have evolved through ClickFix and FileFix tactics to a newer approach called CrashFix, which crashes a victim’s browser and presents a fake fix that installs malware.

Since April 2026, Woodgnat has also been using fake IT helpdesk scenarios through Microsoft Teams chats to push users into running PowerShell commands.

Once executed, a script chain downloads a portable Python environment and launches ModeloRAT, after which attackers conduct deep reconnaissance, harvest credentials, and set up multiple persistence paths.

This layered approach makes the group difficult to fully remove even after initial discovery.

Security researchers recommend monitoring for unusual DLL sideloading activity, especially when legitimate Microsoft executables load unexpected files.

Organizations should also watch for suspicious use of built-in Windows tools such as curl.exe, certutil, WMIC, and PowerShell in contexts outside normal operations.

Tuning endpoint detection toward in-memory execution and tracking abnormal network behavior remain among the most practical defenses against this threat.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.