ModeloRAT and Mistic Backdoor Activity Linked to Ransomware Initial Access Broker

The Python-based remote access trojan ModeloRAT and a newly observed stealth backdoor, dubbed Backdoor.Mistic, to activity consistent with an initial access broker (IAB) operation that facilitates ransomware deployments.

Mistic first seen in April 2026 and publicized by Zscaler as MLTBackdoor access appears optimized for long-term, low-visibility access and was discovered deployed in at least one intrusion alongside ModeloRAT, strengthening ties between these tools and financially motivated access-sellers tracked as Woodgnat (aka KongTuke).

Backdoor.Mistic demonstrates deliberate design choices for stealth and persistence. It is sideloaded through a legitimate executable, MpExtMs.exe, which loads a malicious DLL named EndpointDlp.dll an innocuous-sounding name that mimics Microsoft endpoint-security components.

A loader hooks GetModuleFileNameW and LoadLibraryW to ensure the legitimate binary path is used while forcing the process to load the malicious DLL.

The backdoor executes payloads directly in memory, leaving no files on disk, and includes a kill switch allowing the operator to self-delete features that prioritize long-term covert access and complicate forensic detection.

Functionally, Mistic supports standard backdoor tasks: file upload/download, file and folder manipulation, schedule and frequency adjustments for its command checks, and in-memory execution of C2-delivered code.

Targeting has been opportunistic; compromised organizations span insurance, education, IT and professional services, suggesting the operator’s objective is to establish saleable enterprise access rather than focus on a particular industry vertical.

ModeloRAT continues to be a hallmark of Woodgnat activity. Delivered commonly within a portable WinPython package and run via signed pythonw.exe, ModeloRAT uses RC4-encrypted C2 communications and multi-path resiliency with independent C2 infrastructure.

Symantec’s Threat Hunter Team observed ModeloRAT used in attacks that culminated in Qilin ransomware deployment, linking the RAT to final-stage ransomware activity.

Public reporting also attributes Woodgnat to facilitating access for multiple ransomware families including Qilin, Interlock, Rhysida, Akira, 8Base and Black Basta.

ModeloRAT and Mistic Backdoor Activity

The intrusion chain observed by Symantec combined multiple stages and tools: a .NET credential stealer with a fake login prompt, living-off-the-land utilities such as curl, reg.exe, net.exe, certutil, WMIC and PowerShell for reconnaissance, lateral movement and payload staging, and loaders like WinPython and Node.exe to host ModeloRAT and other scripts.

Zscaler additionally reported Mistic deliveries via Woodgnat-style social-engineering campaigns ClickFix, FileFix and CrashFix lures that trick victims into executing attacker-supplied PowerShell commands.

More recently, Woodgnat has used Microsoft Teams helpdesk pretexts to coerce victims into “paste-and-run” commands, achieving persistent access within minutes.

Operational tradecraft shows emphasis on evasion: signed carriers, in-memory execution, kill switches, credential theft, extensive host profiling, redundant persistence entries masquerading as legitimate remote-access software, and adaptive C2 mechanisms including domain generation for non-domain hosts.

This combination of capabilities and behavior is consistent with an IAB model that prioritizes durable, stealthy enterprise footholds to monetize access to ransomware affiliates.

For defenders, indicators of compromise to prioritize include unexpected loading of EndpointDlp.dll or similarly named DLLs by MpExtMs.exe, anomalous in-memory execution activities, Run-key persistence entries named after remote-support tools, and evidence of WinPython or signed pythonw.exe running unknown scripts.

Tracking Woodgnat-linked infrastructure and the evolution of ModeloRAT and Mistic will be critical as this access-broker model continues to fuel ransomware operations.

Indicators of Compromise (IOCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.