Woodgnat

Woodgnat, also known as KongTuke, is a financially motivated cybercrime threat actor assessed to operate primarily as an initial access broker rather than a state-sponsored group. Active since at least May 2024, the group establishes durable remote access in enterprise environments and sells that access to ransomware affiliates and other attackers. It has been publicly linked to ransomware ecosystems including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Woodgnat’s targeting is described as largely opportunistic. Reported victims span the insurance, education, IT, and professional services sectors, and reporting also mentions schools and insurance firms. The group is associated with the deployment of ModeloRAT, a Python-based remote access trojan, and with the backdoor Mistic, also tracked by Zscaler as MLTBackdoor. In at least one intrusion, Mistic and ModeloRAT were used together. The actor is known for social-engineering-driven initial access. Reported delivery methods include compromised WordPress sites used to serve fake technical alerts and browser-based lures, including ClickFix, FileFix, and CrashFix, that trick users into copying, pasting, or executing malicious PowerShell commands. Since around April 2026, the group has also used external Microsoft Teams messages impersonating IT helpdesk or support personnel to persuade victims to run malicious commands. Observed tradecraft includes multi-stage PowerShell infection chains, DLL sideloading, in-memory execution, credential theft using fake login prompts, reconnaissance with native Windows tools, and use of legitimate utilities including curl, reg.exe, net.exe, PowerShell, certutil, and WMIC. Mistic has been described as a stealthy persistence mechanism that can manage files, execute code received from command-and-control directly in memory, adjust beaconing frequency, and self-delete via a kill switch. Symantec also reported that Woodgnat profiles compromised machines to determine their value and whether access can be sold.