Stealthy new backdoor surfaces in attacks on multiple sectors

Symantec reports a stealthy backdoor named Mistic has been deployed since April 2026 against organizations in insurance, education, IT and professional services. Mistic is linked to Woodgnat (aka KongTuke), a financially motivated initial access broker active since at least May 2024 that has been associated with multiple ransomware operations (Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta). The actor likely provides access for downstream ransomware affiliates, making these intrusions a high-risk vector for disruptive extortion activity.