Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs

A recently discovered self-destructing backdoor, known as Mistic or MLTBackdoor, has been linked to a criminal gang that breaches corporate networks and sells access to ransomware groups. This backdoor, first identified by Zscaler in early June, is believed to facilitate lateral movement in ransomware attacks. Symantec and Carbon Black threat hunters have observed Mistic being used to compromise multiple organizations since April. The backdoor's self-destructing capability allows it to evade detection, making it a formidable tool for malicious actors. The connection to an access broker selling corporate footholds to ransomware gangs underscores the complex and evolving threat landscape¹. This development matters to security practitioners because it highlights the need for robust defenses against sophisticated malware and the importance of monitoring for potential indicators of compromise.