woodgnat

Executive Summary

Woodgnat is a financially motivated initial‑access broker that developed the stealthy Mistic backdoor and ModeloRAT to sell persistence to ransomware operators such as Qilin, Black Basta, and Akira. The group exploits social engineering, compromised WordPress sites, and DLL sideloading via legitimate Microsoft executables to establish in‑memory RATs with a self‑deleting kill switch, then resells the foothold for profit. Its operations span education, insurance, IT, and professional services, making it a key enabler of multi‑stage ransomware campaigns.

Goals & Targeting

Woodgnat’s strategic objectives revolve around monetization through the commercialization of persistent footholds. By providing reliable, stealthy backdoors and credential dumps to multiple ransomware groups, the actor ensures recurring revenue streams without directly deploying destructive payloads. Target selection is opportunistic across sectors that exhibit moderate security maturity—education, insurance, IT services, and professional firms—while exploiting high-value systems such as VMware ESXi hosts or remote‑access infrastructures to maximize payoff for affiliated operators.

Key Capabilities

• initial access brokerage
• remote access via RATs (Mistic, ModeloRAT)
• DLL sideloading through legitimate Microsoft executables
• in‑memory execution with no disk persistence
• self‑delete kill switch for stealth
• credential dumping using Mimikatz and custom stealers
• delivery of malicious lures (ClickFix, FileFix, CrashFix) via compromised WordPress sites
• social engineering including fake CAPTCHAs and Teams helpdesk impersonation
• extensive discovery and reconnaissance (Kerberoasting, PowerShell enumeration)
• lateral movement via RDP and reflective DLL injection on ESXi
• use of RC4‑encrypted DGA-based C2 channels

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

Woodgnat operates in a broker model, establishing long‑term remote access across diverse sectors and selling these footholds to ransomware affiliates. Campaigns begin with opportunistic initial access via lures or exploited web vulnerabilities, followed by RAT deployment, credential harvesting, and subsequent hand‑off to an affiliate. The actor’s operational tempo is high velocity; new backdoor releases, such as Mistic in April 2026, appear quickly and may be adapted for additional ransomware families. Victims commonly come from education, insurance, IT, professional services, and increasingly virtualized environments (VMware ESXi). Notable past operations include the sale of access to Qilin, Black Basta, Interlock, Rhysida, Akira, 8Base, and other multi‑stage ransomware campaigns.

IOC Patterns

• stealth backdoor
• DLL sideloading via legitimate Microsoft executable
• in-memory execution
• self-deleting kill switch
• malicious PowerShell command delivery
• ClickFix/ FileFix / CrashFix lures
• credential dumping via Mimikatz
• RC4-encrypted DGA C2 channels
• watering‑hole compromised WordPress sites
• fake Teams helpdesk messages
• spear-phishing with macro-enabled Office documents
• DNS tunneling

Recommended Actions

• Deploy endpoint detection and response rules for Backdoor.Mistic, ModeloRAT, and KongTuke signatures.
• Block known lure domains (ClickFix, FileFix, CrashFix) at the perimeter and in email filtering solutions.
• Implement application whitelisting to prevent DLL sideloading of EndpointDlp.dll via MpExtMs.exe.
• Enforce strict least‑privilege and MFA for remote access services such as VPN and RDP.
• Monitor PowerShell activity for suspicious cmdlet patterns (download, base64 encoded scripts).
• Detect self-deleting processes and file deletion events indicative of kill switches.
• Configure network segmentation to isolate ESXi hosts from corporate LANs.
• Set up outbound TLS inspection or anomaly detection for RC4‑encrypted HTTP traffic to unknown domains.
• Conduct regular vulnerability scans against public-facing WordPress installations and patch promptly.
• Provide user awareness training focused on malicious lures, fake CAPTCHAs, and Teams impersonations.

Suggested Tags