A newly identified post-exploitation backdoor, MLTBackdoor, is being deployed by a likely ransomware-linked threat actor via a multi-stage ClickFix social engineering chain. The malware sideloads through a legitimate Microsoft Defender binary, uses RC4-encrypted payloads, a date-based Domain Generation Algorithm for resilient C2 communications, and a built-in Beacon Object File (BOF) loader for fileless in-memory post-exploitation — targeting Windows systems globally.
TA2026163MLTBackdoorTLS / Port 443RC4 · AES-256-GCMMLTBackdoor is a sophisticated post-exploitation malware family first identified in 2026, believed to be operated by a ransomware-linked threat actor targeting Windows systems on a global scale. The malware is notable for its multi-stage ClickFix infection chain, heavy anti-analysis capabilities, and a built-in Beacon Object File (BOF) loader that enables fileless, in-memory execution of additional post-exploitation modules — a hallmark of ransomware pre-staging operations.
The MLTBackdoor infection chain begins with a social engineering lure hosted on an automotive-themed website. Victims are deceived into manually copying and pasting malicious commands, which triggers a headless conhost.exe process. This process downloads a compressed archive from a domain generated by a daily Domain Generation Algorithm (DGA), decrypts an RC4-encrypted payload (data.bin), and sideloads the backdoor through the legitimate, signed Microsoft Defender executable mpextms.exe — a sophisticated DLL sideloading technique designed to evade detection.
Once active, MLTBackdoor communicates with its command-and-control (C2) server over TLS on port 443, disguising traffic as legitimate Microsoft telemetry using the Microsoft-DeliveryOptimization/10.1 User-Agent. It employs ECDH key exchange and AES-256-GCM encryption, with a date-based DGA generating fresh C2 domains daily to maintain resilient infrastructure. The malware's BOF loader capability allows ransomware-linked operators to deploy custom modules directly in memory, leaving minimal forensic artifacts on disk.
The MLTBackdoor attack chain unfolds across five distinct stages, combining social engineering, encrypted payload delivery, DLL sideloading, and in-memory execution to establish a persistent, stealthy ransomware foothold on Windows systems.
conhost.exe process. This process creates a temporary directory, retrieves a compressed archive from a DGA-generated domain, extracts data.bin and endpointdlp.dll, and executes the malicious DLL via rundll32. The DLL acts as a first-stage loader for the MLTBackdoor payload.endpointdlp.dll decrypts the RC4-encrypted data.bin to deploy MLTBackdoor. The malware performs a self-update, then disguises itself by sideloading through the legitimate, signed Microsoft Defender binary mpextms.exe. To defeat analysis, it employs Mixed Boolean-Arithmetic (MBA) and Control Flow Flattening (CFF) obfuscation, dynamically resolves APIs and system calls using DJB2 hashing, and leverages Hell's Gate-style indirect syscalls to bypass user-mode API hooks and evade security monitoring.443, masquerading as Microsoft telemetry traffic using the Microsoft-DeliveryOptimization/10.1 User-Agent and the fixed URL path /api/v1/telemetry. Communications are secured with ECDH key exchange and AES-256-GCM encryption. A date-based DGA generates fresh domains daily to ensure C2 continuity if primary infrastructure is disrupted. In one observed case, the same DGA domain served both as a malware delivery endpoint and a C2 channel, highlighting the tightly integrated and resilient nature of MLTBackdoor's infrastructure.Security teams should implement the following prioritized mitigations to detect, disrupt, and prevent MLTBackdoor infections and ClickFix-based ransomware delivery chains across Windows environments.
mpextms.exe sideloading a DLL named endpointdlp.dll. Broaden monitoring to detect any trusted Microsoft Defender binaries loading DLLs from user-writable or temporary directories — a strong indicator of DLL sideloading abuse characteristic of MLTBackdoor's execution technique./api/v1/telemetry and outbound requests using the Microsoft-DeliveryOptimization/10.1 User-Agent to atypical or newly registered domains. MLTBackdoor specifically uses these patterns to disguise malicious C2 traffic as legitimate Microsoft telemetry.The following indicators are associated with MLTBackdoor infrastructure, payload delivery, and C2 communications. Block these across endpoint, network, and DNS controls immediately.
| Type | Value |
|---|---|
| SHA256 |
1e41c7bfaa6aa3b93b6cc024274a10e33f3e12fe7c98c1db387ef8927f9d198446b2155c1e71b840d4b7a2e94410b89a61e2446523e6f497206d402eb02e0e939e52cc90cff150abe21f0a6440e86e0a99ff383b81061b96def8948e21d0ac66ced6b0f44410f6133ad63b61e04613a8b56cc3338d7b34497540e9541163e7ec1d09357b6a096fdc35cd5c873eed15665d6b3c879d20c8cf01e6bca0005512cf2cd88d5280a61714836f5f07a16df190911c5b952af2998dbbcda910b3b1c494d34e4038c5c80728f9648ba84833f69bc1ccea82e2e8e748b7b7f02fb687b92b
|
| Domains |
hrs2y15sungu[.]comcarrolc[.]comcwrtwright[.]comthomphon[.]com
|
| URL | hxxps[:]//powwowski[.]com/payloads/update[.]zip |
The following MITRE ATT&CK tactics, techniques, and sub-techniques have been identified in association with the MLTBackdoor ClickFix ransomware foothold campaign.
| Tactic | Technique ID | Sub-technique ID | Description |
|---|---|---|---|
| Initial Access | T1566 |
— | Phishing — ClickFix lure on automotive-themed website delivers initial infection |
| Execution | T1204 |
T1204.001 — Malicious Link |
User Execution — victim manually copies and executes malicious clipboard content |
| Execution | T1059 |
T1059.003 — Windows Command Shell |
Command and Scripting Interpreter — headless conhost.exe and rundll32 used to execute the DLL payload |
| Execution | T1106 |
— | Native API — direct system calls used via Hell's Gate-style indirect syscalls |
| Defense Evasion | T1574 |
T1574.001 — DLL |
Hijack Execution Flow — endpointdlp.dll sideloaded via legitimate signed mpextms.exe Microsoft Defender binary |
| Defense Evasion | T1027 |
T1027.007 — Dynamic API Resolution |
Obfuscated Files or Information — MBA, Control Flow Flattening, and DJB2-based dynamic API resolution used to hinder analysis |
| Defense Evasion | T1106 |
— | Native API — indirect syscalls bypass user-mode security hooks |
| Defense Evasion | T1497 |
— | Virtualization/Sandbox Evasion — checks for VM, sandbox, and low-memory indicators; results reported to C2 |
| Defense Evasion | T1622 |
— | Debugger Evasion — active anti-debugging routines deployed to hinder reverse engineering |
| Defense Evasion | T1620 |
— | Reflective Code Loading — BOF loader executes post-exploitation modules in memory without touching disk |
| C2 | T1071 |
T1071.001 — Web Protocols |
Application Layer Protocol — C2 traffic sent over TLS port 443 masquerading as Microsoft telemetry |
| C2 | T1573 |
T1573.002 — Asymmetric Cryptography |
Encrypted Channel — ECDH key exchange used to establish encrypted C2 sessions |
| C2 | T1573 |
T1573.001 — Symmetric Cryptography |
Encrypted Channel — AES-256-GCM symmetric encryption used for C2 payload confidentiality |
| C2 | T1568 |
T1568.002 — Domain Generation Algorithms |
Dynamic Resolution — date-based DGA generates daily C2 domains; same DGA domain observed for both delivery and C2 |
| C2 | T1105 |
— | Ingress Tool Transfer — compressed payload archive downloaded from DGA-generated delivery domains |
| Discovery | T1057 |
— | Process Discovery — malware enumerates running processes as part of anti-analysis and environment fingerprinting |
| Discovery | T1082 |
— | System Information Discovery — system info gathered to detect VMs, sandboxes, and analysis environments |
| Discovery | T1083 |
— | File and Directory Discovery — malware performs file system enumeration as part of post-exploitation reconnaissance |
| Exfiltration | T1041 |
— | Exfiltration Over C2 Channel — data and anti-analysis findings exfiltrated via the existing encrypted C2 connection |
| Impact | T1486 |
— | Data Encrypted for Impact — consistent with ransomware-linked operations; BOF loader enables in-memory ransomware module deployment |
