ModeloRAT and Mistic Backdoor Activity Linked to Ransomware Initial Access Broker

2026-06-25

Symantec and Zscaler have linked the Python-based ModeloRAT and the new in-memory, disk-less Backdoor.Mistic to the financially motivated access-broker Woodgnat (aka KongTuke). Woodgnat's lures have been used to deploy Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta ransomware. Defenders are advised to hunt for specific DLL loads and persistence methods associated with these attacks.