New Mistic Backdoor Targets Insurance, Education, IT Firms

A stealthy backdoor named Mistic has been deployed since April 2026 against organizations in insurance, education, IT, and professional services. Symantec and Carbon Black link it to the KongTuke initial access broker, used in ClickFix and ModeloRAT campaigns. The malware enables persistent remote access for financially motivated attacks.