Hackers Use ClickFix Chain to Deploy MLTBackdoor Malware

A sophisticated new backdoor family, tracked as MLTBackdoor, that operators are deploying through a multi-stage ClickFix infection chain to establish footholds for ransomware and follow-on activity.

The campaign begins with an automotive-themed ClickFix lure: when a victim copies, pastes, and executes the supplied commands, a compressed archive fetched from a DGA-generated domain drops two artifacts endpointdlp.dll and an RC4-encrypted payload (data.bin).

The DLL decrypts data.bin, which contains the MLTBackdoor payload; the malware self-updates, reuses the endpointdlp.dll name and sideloads via a legitimate signed Microsoft Defender executable to gain execution stealth.

MLTBackdoor is engineered for resilience and modularity. At its core it supports filesystem commands download, upload, ls, delete, rename, mkdir but its defining capability is a Beacon Object File (BOF) loader.

The BOF loader can map MS-COFF objects into memory, resolve a compact set of Beacon-style imports (including BeaconDataParse, BeaconPrintf and others), apply relocations, set execute permissions, run the entry point and return results.

That BOF compatibility gives operators wide flexibility to push post-exploitation modules without dropping additional binaries.

The authors of MLTBackdoor invested heavily in anti-analysis and obfuscation. An LLVM-based obfuscator applies Mixed Boolean-Arithmetic (MBA) and Control Flow Flattening (CFF) so that simple arithmetic and state transitions balloon into dense, noisy code paths ThreatLabz estimates roughly 95% of the compiled logic is obfuscation noise.

MLTBackdoor Malware

Zscaler ThreatLabz said in a report shared with GBhackers, a new malware family that we track as MLTBackdoor that is likely leveraged by a ransomware-related threat actor.

Strings are built dynamically on the stack across flattened state machines to defeat static string-finding tools. API resolution is hashed using DJB2 and executed at runtime, including a special convention of prefixing “Beacon” for some imports.

To evade monitoring, MLTBackdoor performs indirect system calls (Hell’s Gate-style), building a runtime syscall table from ntdll exports and jumping to syscall gadgets rather than calling hooked Win32 wrappers.

Multiple anti-analysis checks are aggregated into a bitmask and exfiltrated in the initial check-in. Unlike most malware families, string values are not encrypted or encoded. Instead the strings are constructed at runtime byte-by-byte on the stack.

These checks include hypervisor vendor checks, timing loops, debugger detection, process and window-title scanning for analysis tools, driver name checks, low-RAM/CPU/uptime heuristics and more. Detection does not stop the implant but informs operators about the execution environment.

Network communications use a custom encrypted binary protocol over TLS on port 443 with the fixed path /api/v1/telemetry and a Microsoft-like User-Agent to blend in.

MLTBackdoor uses ECDH to generate a shared secret that is used as an AES session key.

Sessions negotiate an ephemeral Elliptic-Curve Diffie-Hellman (P‑256) key exchange, derive an AES-256-GCM session key and exchange framed packets with a small header whose magic bytes spell “MLT” (0x014D4C54).

The implant supports message types for check-in, BOF tasks, file transfer, command results and control commands; it also implements a deterministic date-based domain generation algorithm (DGA) to provide fallback C2 connectivity when hardcoded domains are unavailable.

ThreatLabz made an MLTBackdoor DGA script and related indicators available on their GitHub.

Operationally the combination of ClickFix social engineering, DLL sideloading, heavy obfuscation, Hell’s Gate syscall evasion and BOF extensibility makes MLTBackdoor a resilient post-exploitation framework attractive to ransomware-linked operators.

Defenders should monitor for the specific DGA domains and download patterns described by ThreatLabz, inspect suspicious use of mpextms.exe or endpointdlp.dll, and flag anomalous outbound TLS sessions to /api/v1/telemetry.

Indicators Of Compromise (IOCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.