Story 1theregister•Jun 25, 2026
Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs
Signal strongSource-grounded
What happened
Researchers from Symantec and Carbon Black describe a memory‑only backdoor called Mistic seen in intrusions across insurance, education, IT, and professional services. The backdoor runs payloads in memory and checks for commands from a remote controller without writing files to disk, which helps it evade file‑based detection and lengthens forensic work. Watch for stronger forensic linkage to initial‑access brokers and for repeated resale of footholds that expand incident scope
Why the category manager should care
Treat Mistic as an operationally real threat that increases incident complexity because it avoids disk detection and enables resale of footholds
Key facts
- Observed in multiple sector intrusions since April
- Executes remote payloads in memory to avoid disk artifacts
- Reported linkage to initial‑access brokers and remote access trojans