A stealthy fileless backdoor called Mistic has been identified as the primary initial-access vehicle for an access broker tracked as KongTuke (designated Woodgnat by Symantec), which has been selling confirmed corporate footholds to at least six active ransomware operations: Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Security researchers published findings on June 25, 2026, documenting activity that has been ongoing since at least April 2026 across insurance, education, IT, and professional services organisations.
How Mistic Works
Mistic is memory-resident and file-free. It executes entirely in process memory and leaves no executable artifacts on disk, which means traditional file-based endpoint scans and antivirus tooling will not detect it. The backdoor includes a built-in kill switch that triggers self-destruction for anti-forensics purposes when the operator executes it or when detection conditions are met, complicating post-compromise investigation.
Delivery relies on social engineering lures in the ClickFix, FileFix, and CrashFix families — browser-based deception techniques that instruct targets to execute commands in PowerShell or the Windows Run dialog under the pretence of fixing a technical problem. Mistic is commonly deployed alongside ModeloRAT, a secondary remote access tool observed in the same intrusion chains.
The Access Broker Model
KongTuke operates as a pure initial access broker: its role ends at gaining and verifying a foothold inside a target network. Confirmed access is then sold to ransomware affiliates operating under the above groups. The broker model has strategic advantages for all parties: KongTuke limits its own operational exposure by not conducting follow-on activity, while ransomware affiliates acquire pre-validated access at a fraction of the effort required to breach targets independently.
The breadth of ransomware groups drawing from KongTuke’s supply — six confirmed operations — indicates a well-established, high-volume brokerage. Organisations in any of the targeted verticals should treat this as a live supply chain threat to their network perimeter, independent of which downstream ransomware group is ultimately active at the time of exploitation.
Sector Implications
Finance and insurance. Insurance has been explicitly named as a targeted vertical in observed KongTuke campaigns. The operational model of ransomware groups purchasing validated access means sector-specific targeting may shift at any time based on which affiliate acquires a given foothold. Finance sector organisations face elevated risk from Qilin and Black Basta, both of which have demonstrated previous activity in the sector.
Professional services and IT. IT service providers and professional services firms represent high-value access points given their connectivity to client environments. A compromised IT provider within KongTuke’s sold portfolio may be used as a pivot into downstream client networks — a pattern consistent with previous access broker operations.
Recommended Actions
-
Hunt for ClickFix and FileFix execution patterns. Review EDR telemetry and PowerShell logs for execution commands characteristic of ClickFix-style lures:
mshta,wscript, or direct PowerShell invocations initiated from browser processes or social engineering contexts. ClickFix has a documented signature pattern that detection engineers should have rules for. -
Deploy memory-based detection. File-based AV will not detect Mistic. Ensure endpoint detection covers in-memory process anomalies, hollow process injection, and unsigned code running in memory regions not associated with a file on disk. YARA rules for memory scanning and behavioral rules for anomalous parent-child process relationships are the primary detection surface.
-
Check for ModeloRAT co-infection. ModeloRAT is file-based and may leave detectable artifacts even if Mistic does not. Scan for known ModeloRAT indicators from threat intelligence feeds published alongside the June 25 disclosures.
-
Review external-facing remote access. KongTuke access is typically sold with credential-level access to the target environment. Audit all active VPN sessions, RDP gateway accounts, and cloud management console access for accounts showing unusual activity since April 2026.