{
  "name": "New Backdoor May be Linked to Ransomware Access Broker",
  "slug": "new-backdoor-may-be-linked-to-ransomware-access-broker",
  "description": "A stealthy new backdoor called Mistic has been deployed in cybercrime intrusions since April 2026, potentially linked to Woodgnat, an initial access broker associated with multiple ransomware operations including Qilin, Interlock, Rhysida, Akira, 8Base and Black Basta. Mistic was deployed alongside ModeloRAT in at least one case, a tool developed by Woodgnat. The backdoor uses sideloading techniques through legitimate Microsoft files and executes payloads in memory without writing to disk. It includes typical backdoor capabilities plus a self-delete kill switch for enhanced stealth. Targeting appears opportunistic across insurance, education, IT and professional services sectors. Woodgnat operates as an IAB, establishing durable remote access within enterprises and selling this access to ransomware affiliates, using various social-engineering techniques including ClickFix, FileFix and CrashFix lures delivered through compromised WordPress sites.",
  "published": "2026-06-24T13:40:02.336000+00:00",
  "created_at": "2026-06-24T18:17:39.618000+00:00",
  "modified_at": null,
  "created_at_opencti": "2026-06-24T18:17:39.618000+00:00",
  "author": "AlienVault",
  "confidence": 100,
  "report_types": [
    "threat-report"
  ],
  "labels": [
    "backdoor.mistic",
    "credential stealer",
    "d3f@ck loader",
    "gatekeeper",
    "initial access broker",
    "mintsloader",
    "modelorat",
    "nexshield",
    "qilin",
    "ransomware",
    "sideloading",
    "social-engineering"
  ],
  "tags": [],
  "related_entities": {
    "indicators": [
      {
        "id": "1f964282-e7b7-4a92-bddf-07ea17d2068f",
        "name": "upd-domain-goloro.com"
      },
      {
        "id": "36023de8-6766-4515-b9d1-3eac4416b289",
        "name": "mails.updater-worelos.com"
      },
      {
        "id": "86bb168c-e68d-4b25-8319-b210f022daab",
        "name": "oeannon.com"
      },
      {
        "id": "69b957cb-c4be-4add-83e5-286540da62d2",
        "name": "fb3630822b70bacb56aa4cec29b5a0e3e9acb3920809e70310a4003385a6d34a"
      },
      {
        "id": "d0278c9e-385a-415d-9411-fca4ea2c0f25",
        "name": "updater-worelos.com"
      },
      {
        "id": "7004c009-308a-437f-aba8-d47a54cbab8c",
        "name": "nano.upscale-kolo.com"
      },
      {
        "id": "91e1d68e-b5d9-4aef-9978-67f523d4fb4d",
        "name": "1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984"
      },
      {
        "id": "1f53620b-c324-4d99-9477-a5532c6ab610",
        "name": "afd5f1ed45a9867daf3bc64152cef460a06b164c8183e490db39146d4749a82c"
      },
      {
        "id": "f7fe7adc-a868-413d-95bc-cd6a0fcfe52f",
        "name": "144.31.53.78"
      },
      {
        "id": "2949237c-4051-4e74-b10a-a2c22db48c03",
        "name": "3f797a639bc855bc6d5471f327924b62d10900ddec49b970eca6604142bbb4be"
      },
      {
        "id": "1eb64520-ecf0-4c24-b509-51a6173749cd",
        "name": "human-check.top"
      },
      {
        "id": "1e2b040a-36fa-461f-9021-34fcf5e1724f",
        "name": "rotoa-upda-lo.com"
      },
      {
        "id": "29a5b543-eeae-4339-8d27-c353084de735",
        "name": "carrolc.com"
      },
      {
        "id": "201f2393-ec98-4204-859d-0c93c036f08e",
        "name": "defs.updater-worelos.com"
      },
      {
        "id": "a5b9c049-a332-4577-8a13-c1a0c531cbe5",
        "name": "grande-luna.top"
      },
      {
        "id": "8fbf31de-9e14-430e-a022-79e9725f1039",
        "name": "db972979d508e75fe730d3b72c2701470fbdaeaf8ebdd674744754fa44438ca5"
      },
      {
        "id": "74ae0682-014e-4e50-a295-73876ad8f0db",
        "name": "b6w9m2z5x8q1v3k.top"
      },
      {
        "id": "42d43a1e-af78-40c0-a95c-756e39c07910",
        "name": "ftps.upd-domain-goloro.com"
      },
      {
        "id": "9b0a7781-8c68-4e51-800e-1ef2583e6fe8",
        "name": "php.authorized-logins.net"
      },
      {
        "id": "1e4d5eb2-2b46-457f-bcd7-42ca9c269798",
        "name": "mueleer.com"
      },
      {
        "id": "598f1373-e929-44e0-942a-d349d9f0a521",
        "name": "http://thomphon.com/update.msi"
      },
      {
        "id": "0cbfd349-be0f-4c78-8b3c-1e233f5f73e5",
        "name": "8c935feec4bd05d5d918df308be417532fb42608fb989a08eab183e0ae699235"
      },
      {
        "id": "145e1bca-7102-4b81-a002-7a80b8d51880",
        "name": "198.13.159.44"
      },
      {
        "id": "9ff284cb-becc-4d0b-bc4d-e498d737cd6a",
        "name": "f591275a8f014b29e567529d67c54eb7bb4473db1c38737d6bfd5b3d52c9344e"
      },
      {
        "id": "ca9f155c-097d-465f-a51d-c235cad65ab6",
        "name": "mailes.upd-domain-goloro.com"
      },
      {
        "id": "202fb033-da52-4942-b506-2a9be391e491",
        "name": "authorized-logins.net"
      },
      {
        "id": "86698217-27f2-46dc-a45a-9b7e93259a2b",
        "name": "199.91.221.42"
      },
      {
        "id": "b82aa124-e7d8-4599-a2a8-30114dd75cc4",
        "name": "sss.authorized-logins.net"
      },
      {
        "id": "be1f86c1-bd42-488b-9b77-f1291afa3664",
        "name": "thomphon.com"
      },
      {
        "id": "09d38f24-4cf5-4e34-8995-d51f0d814967",
        "name": "59e3c4cb06331b4f2d78a9a0592f3747e573bd01c5a7650c26361d1e25520712"
      },
      {
        "id": "df74b102-57e1-4025-933f-eda4249bf1d0",
        "name": "w3xasv14culvnqj.top"
      },
      {
        "id": "79b70009-74a9-4575-9a62-787ba967ff2f",
        "name": "34d798a6c55e57ed0932b6499f4fbcb5454bdfca903307be101a0594b0ac07bc"
      },
      {
        "id": "b6e2cd3b-d18e-4b1f-a1b3-9ad22a0a4898",
        "name": "mail.authorized-logins.net"
      },
      {
        "id": "47a9f7ee-8cf4-43ff-98dd-9bb7b9bb8ce1",
        "name": "cwrtwright.com"
      },
      {
        "id": "da8a8b1b-1056-4dc1-b807-762eb2075d51",
        "name": "update.update-fall.com"
      },
      {
        "id": "d6f7aa73-6751-4372-9056-b3acf9e8b0b6",
        "name": "upscale-kolo.com"
      },
      {
        "id": "248127d5-0491-43b3-82dd-3ca2dfda2eae",
        "name": "sql-updater-service.com"
      }
    ],
    "intrusion_sets": [
      {
        "id": "18cafddf-2600-44c1-9189-dca6362a74bc",
        "name": "Woodgnat",
        "slug": "woodgnat"
      }
    ],
    "attack_patterns": [
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "6b5f1e68-aec7-4ea0-9777-62156da790a7",
        "name": "T1069"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "a72b6e11-a5d5-4f5a-8f0d-8861e90c34f7",
        "name": "T1555"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "09124a92-c11f-4571-b35b-ab0bce6dd081",
        "name": "T1112"
      },
      {
        "id": "40f0d8e3-bcd7-4b97-a958-f55815698fc5",
        "name": "T1053.005"
      },
      {
        "id": "f6ceeba2-b50c-47dc-8642-ab9842ca76d7",
        "name": "T1018"
      },
      {
        "id": "fd6a3ae8-f3af-41a6-9292-09912a059105",
        "name": "T1558.003"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "6efb8bea-11d7-418d-a429-9f4a3e6c50f6",
        "name": "T1087"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "8e0fea81-4d54-4e88-a7dd-3aa8b26558ed",
        "name": "T1113"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ],
    "malware": [
      {
        "id": "793460da-ff23-42e1-8356-8145b19df7cd",
        "name": "ModeloRAT",
        "slug": "modelorat"
      },
      {
        "id": "6c0e2f55-8d8e-4e88-aadd-de3cb14de0d0",
        "name": "NexShield",
        "slug": "nexshield"
      },
      {
        "id": "fcc09515-91fd-4fa3-ac13-f551651cd0ea",
        "name": "Backdoor.Mistic",
        "slug": "backdoormistic"
      },
      {
        "id": "038e063c-cead-4de8-902e-d6fabcd78a08",
        "name": "MintsLoader",
        "slug": "mintsloader"
      },
      {
        "id": "81dcf744-5324-432c-a23c-f5e7a16a3489",
        "name": "GateKeeper",
        "slug": "gatekeeper"
      },
      {
        "id": "249645dd-1e92-4901-932d-80eb0efe774e",
        "name": "D3F@ck Loader",
        "slug": "d3fck-loader"
      }
    ],
    "observables": [
      {
        "id": "c7199bbc-5ca8-459c-8022-6374bca46812",
        "name": "authorized-logins.net"
      },
      {
        "id": "8cab2700-4cd5-4de8-b4f4-a3e75404369b",
        "name": "mueleer.com"
      },
      {
        "id": "00b24e76-e38a-47dd-85c7-845241ba4aee",
        "name": "rotoa-upda-lo.com"
      },
      {
        "id": "9626476b-d35a-4792-b5e3-4d44781554e0",
        "name": "cwrtwright.com"
      },
      {
        "id": "77e4e7a1-e977-42d7-8f97-9939114f7e0a",
        "name": "updater-worelos.com"
      },
      {
        "id": "16df5cad-f905-405f-9ad5-07c2873e3672",
        "name": "upd-domain-goloro.com"
      },
      {
        "id": "f4519e6c-878b-48ae-8316-9e39b3abe058",
        "name": "w3xasv14culvnqj.top"
      },
      {
        "id": "ce49d5f1-e720-475c-8e2e-8e1febe0ddc0",
        "name": "oeannon.com"
      },
      {
        "id": "8d73c88d-15de-4c93-ae4c-eb2638d76674",
        "name": "sql-updater-service.com"
      },
      {
        "id": "dafa7691-7ec8-476f-a910-be2f167b03a1",
        "name": "carrolc.com"
      },
      {
        "id": "f3c4b289-5fa8-4231-aa0f-a94c81b067cf",
        "name": "grande-luna.top"
      },
      {
        "id": "aaa1eb44-9fce-4ada-b899-bafd0025a0e6",
        "name": "upscale-kolo.com"
      },
      {
        "id": "786d53be-c4ed-44b2-a778-44c753a87354",
        "name": "thomphon.com"
      },
      {
        "id": "77ac903a-6322-4df6-89d3-2b92527050ab",
        "name": "b6w9m2z5x8q1v3k.top"
      },
      {
        "id": "f021de8b-e53b-4171-95bb-2dcb8fd4244e",
        "name": "human-check.top"
      },
      {
        "id": "2c92d8ef-88cb-455e-9980-f185c38931e5",
        "name": "mail.authorized-logins.net"
      },
      {
        "id": "84e798bd-2b9c-4c53-ae39-9dd58ba79586",
        "name": "mailes.upd-domain-goloro.com"
      },
      {
        "id": "6085fd46-b7ad-4cbb-bcae-19c8bd0616a5",
        "name": "php.authorized-logins.net"
      },
      {
        "id": "e6a86295-a1a1-4800-ad04-809a82f65497",
        "name": "nano.upscale-kolo.com"
      },
      {
        "id": "cff94843-a025-4ffb-ac6f-de1b52a8f179",
        "name": "sss.authorized-logins.net"
      },
      {
        "id": "706cb95c-2a9e-4771-bfd7-b53212bdb562",
        "name": "ftps.upd-domain-goloro.com"
      },
      {
        "id": "8c7037f5-bb93-4c58-99b2-be942583ddd5",
        "name": "defs.updater-worelos.com"
      },
      {
        "id": "c72ff44d-9277-46c1-9569-23fde8993768",
        "name": "mails.updater-worelos.com"
      },
      {
        "id": "42ecd887-e014-43aa-85bd-489eb35272cd",
        "name": "update.update-fall.com"
      },
      {
        "id": "f289c09c-4d4a-45fc-9157-6fe2e69a9d5a",
        "name": "144.31.53.78"
      },
      {
        "id": "e46f06df-3cdf-472c-868a-92c0f3affe9d",
        "name": "198.13.159.44"
      },
      {
        "id": "72339434-3222-4d6a-aac0-1b0c052f25e1",
        "name": "199.91.221.42"
      },
      {
        "id": "2141975f-a1e7-4597-9a8a-defc9f6d6d15",
        "name": "http://thomphon.com/update.msi"
      }
    ]
  },
  "external_refs": [
    {
      "id": "5831d13d-e496-49d2-8596-409a293975a0",
      "standard_id": "external-reference--2f20bf4c-547e-5e9a-9a93-e4b3b0a053e4",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://otx.alienvault.com/pulse/6a3bde32e46aafdb90f9593b",
      "hash": null,
      "external_id": "6a3bde32e46aafdb90f9593b",
      "created": "2026-06-24T18:17:38.329Z",
      "modified": "2026-06-24T18:17:38.329Z",
      "createdById": null
    },
    {
      "id": "fb8ca12a-34c9-4f1e-99b0-aa64a4fb927b",
      "standard_id": "external-reference--44d435e0-90ba-554b-94f2-bbfb67caeb88",
      "entity_type": "External-Reference",
      "source_name": "AlienVault",
      "description": null,
      "url": "https://www.security.com/threat-intelligence/new-mistic-backdoor-modelorat",
      "hash": null,
      "external_id": null,
      "created": "2026-06-24T18:17:38.385Z",
      "modified": "2026-06-24T18:17:38.385Z",
      "createdById": null
    }
  ]
}