ShellCodeX Intelligence Brief
HIGH
Cybersecurity
Mistic stealth backdoor connects KongTuke and ModeloRAT campaigns
Source headline: New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns
Threat level
High
Signal strength
78/100
Source confidence
1 source
Published
2 hours ago
Intelligence Summary
Symantec and Carbon Black link a stealthy backdoor called Mistic (also tracked as MLTBackdoor) to financially motivated intrusions. The activity has targeted organizations across insurance, education, IT, and professional services since April 2026. The campaign chain is reported to involve KongTuke as an initial access broker. Victims may see malware staging and persistence attempts under the Mistic name. Organizations should review endpoint detections for MLTBackdoor indicators and validate access broker activity in their environment.
Recommended Action
Review affected assets, schedule urgent remediation, and monitor related indicators.
Topics
Original reporting
The Hacker News
New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns
Open original source