New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns

Security researchers have uncovered a new stealthy backdoor, dubbed Mistic, that has been actively deployed in sophisticated cyberattacks targeting multiple industries. The discovery, made by Symantec and Carbon Black's Threat Hunter Team, reveals an alarming threat landscape where financial motivation drives attacks against organizations in insurance, education, IT, and professional services sectors since April 2026. The backdoor, alternatively tracked as MLTBackdoor, has been linked to an initial access broker known as KongTuke, who has been weaponizing this threat alongside other malware families including ClickFix and ModeloRAT in coordinated campaigns.

The Mistic backdoor represents an evolution in persistent threat capabilities, designed to provide attackers with remote access to compromised systems while remaining undet