New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns

A newly discovered backdoor called Mistic has been used in targeted attacks on various organizations across multiple sectors, including insurance, education, and IT, since April 2026. The attacks are believed to be financially motivated. The Mistic backdoor is also known as MLTBackdoor. It has been linked to an initial access broker. The backdoor's deployment has been observed in campaigns alongside ClickFix and ModeloRAT. Symantec and Carbon Black's Threat Hunter Team have been tracking the Mistic backdoor.