Hackers Use ClickFix Chain to Deploy MLTBackdoor Malware

A sophisticated new backdoor family, tracked as MLTBackdoor, that operators are deploying through a multi-stage ClickFix infection chain to establish footholds for ransomware and follow-on activity.

The campaign begins with an automotive-themed ClickFix lure: when a victim copies, pastes, and executes the supplied commands, a compressed archive fetched from a DGA-generated domain drops two artifacts endpointdlp.dll and an RC4-encrypted payload (data.bin).

The DLL decrypts data.bin, which contains the MLTBackdoor payload; the malware self-updates, reuses the endpointdlp.dll name and sideloads via a legitimate signed Microsoft Defender executable to gain execution stealth.

MLTBackdoor is engineered for resilience and modularity. At its core it supports filesystem commands download, upload, ls, delete, rename, mkdir but its defining capability is a Beacon Object File (BOF) loader.

The BOF loader can map MS-COFF objects into memory, resolve a compact set of Beacon-style imports (including BeaconDataParse, BeaconPrintf and others), apply relocations, set execute permissions, run the entry point and return results.

That BOF compatibility gives operators wide flexibility to push post-exploitation modules without dropping additional binaries.

The authors of MLTBackdoor invested heavily in anti-analysis and obfuscation. An LLVM-based obfuscator applies Mixed Boolean-Arithmetic (MBA) and Control Flow Flattening (CFF) so that simple arithmetic and state transitions balloon into dense, noisy code paths ThreatLabz estimates roughly 95% of the compiled logic is obfuscation noise.

MLTBackdoor Malware

Zscaler ThreatLabz said in a report shared with GBhackers, a new malware family that we track as MLTBackdoor that is likely leveraged by a ransomware-related threat actor.

Strings are built dynamically on the stack across flattened state machines to defeat static string-finding tools. API resolution is hashed using DJB2 and executed at runtime, including a special convention of prefixing “Beacon” for some imports.

To evade monitoring, MLTBackdoor performs indirect system calls (Hell’s Gate-style), building a runtime syscall table from ntdll exports and jumping to syscall gadgets rather than calling hooked Win32 wrappers.

Multiple anti-analysis checks are aggregated into a bitmask and exfiltrated in the initial check-in. Unlike most malware families, string values are not encrypted or encoded. Instead the strings are constructed at runtime byte-by-byte on the stack.

These checks include hypervisor vendor checks, timing loops, debugger detection, process and window-title scanning for analysis tools, driver name checks, low-RAM/CPU/uptime heuristics and more. Detection does not stop the implant but informs operators about the execution environment.

Network communications use a custom encrypted binary protocol over TLS on port 443 with the fixed path /api/v1/telemetry and a Microsoft-like User-Agent to blend in.

MLTBackdoor uses ECDH to generate a shared secret that is used as an AES session key.

Sessions negotiate an ephemeral Elliptic-Curve Diffie-Hellman (P‑256) key exchange, derive an AES-256-GCM session key and exchange framed packets with a small header whose magic bytes spell “MLT” (0x014D4C54).

The implant supports message types for check-in, BOF tasks, file transfer, command results and control commands; it also implements a deterministic date-based domain generation algorithm (DGA) to provide fallback C2 connectivity when hardcoded domains are unavailable.

ThreatLabz made an MLTBackdoor DGA script and related indicators available on their GitHub.

Operationally the combination of ClickFix social engineering, DLL sideloading, heavy obfuscation, Hell’s Gate syscall evasion and BOF extensibility makes MLTBackdoor a resilient post-exploitation framework attractive to ransomware-linked operators.

Defenders should monitor for the specific DGA domains and download patterns described by ThreatLabz, inspect suspicious use of mpextms.exe or endpointdlp.dll, and flag anomalous outbound TLS sessions to /api/v1/telemetry.

Indicators Of Compromise (IOCs)

SHA256	Description
1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d1984	Stage one loader.
46b2155c1e71b840d4b7a2e94410b89a61e2446523e6f497206d402eb02e0e93	Archive with stage one loader and encrypted MLTBackdoor.
9e52cc90cff150abe21f0a6440e86e0a99ff383b81061b96def8948e21d0ac66	MLTBackdoor with domains and DGA.
ced6b0f44410f6133ad63b61e04613a8b56cc3338d7b34497540e9541163e7ec	MLTBackdoor DGA only.
1d09357b6a096fdc35cd5c873eed15665d6b3c879d20c8cf01e6bca0005512cf	MLTBackdoor DGA only.
2cd88d5280a61714836f5f07a16df190911c5b952af2998dbbcda910b3b1c494	MLTBackdoor domains only.
d34e4038c5c80728f9648ba84833f69bc1ccea82e2e8e748b7b7f02fb687b92b	MLTBackdoor update sideload archive.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.