New Backdoor May be Linked to Ransomware Access Broker

Reported 24 Jun 2026 by otx · Severity: medium

A stealthy new backdoor called Mistic has been deployed in cybercrime intrusions since April 2026, potentially linked to Woodgnat, an initial access broker associated with multiple ransomware operations including Qilin, Interlock, Rhysida, Akira, 8Base and Black Basta. Mistic was