New ‘Mistic’ RAT Opens Door to Several Ransomware Families

A threat actor known as Woodgnat has been deploying a new remote access trojan called Mistic RAT in attacks against organizations across education, insurance, IT, and professional services sectors. The group functions as an initial access broker with ties to multiple ransomware families including Qilin, Black Basta, and Akira, casting a wide net to identify victims they can sell network access to. The attacks often use social engineering tactics through compromised WordPress sites and fake IT-support lures via Microsoft Teams to trick victims into executing malicious PowerShell commands.