← threat actors
threat actor · not yet in the cluster map
kongtuke
also tracked as clickfix 1, 8base 1, akira 1, black basta 1, interlock 1, qilin 1, rhysida 1, woodgnat 1
2 stories · 2 in the wild · June 25, 2026 – June 30, 2026
evidence: 2 observed
sectors
- technology 2 · Jun 30
- education 1 · Jun 25
malware and tools
- havoc c2 1 · Jun 30
- mistic 1 · Jun 25
techniques
- defense evasion 1 · Jun 30
- dll sideloading 1 · Jun 30
- evasion 1 · Jun 30
attack phases seen
- Command and control 1 · Jun 30
- Credential access 1 · Jun 30
- Execution 1 · Jun 30
- Initial access 1 · Jun 25
what we reported, newest first, grouped by story
June 30, 2026
- Unit 42 detailed a new Kongtuke (ClickFix) campaign sideloading Havoc C2 via a signed WinWrapIDE binary, with an evasive loader using window cloaking, sandbox sleep, and native callback evasion to run a memory-only infostealer. Unit 42
· Jun 30 · observed · as clickfix · Threat Activity
Jun 19 – June 25, 2026
- Mistic, a stealthy new RAT, is the entry point for initial-access broker Woodgnat (aka KongTuke), who feeds ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta, hitting insurance, education, IT, and professional-services targets. BleepingComputer, SecurityWeek
· Jun 25 · observed · as woodgnat, qilin, interlock, rhysida, akira, 8base, black basta · Threat Intelligence