Executive Summary
In May 2026, a new malware family dubbed MLTBackdoor was identified, likely operated by ransomware-related threat actors to maintain persistent access. The infection utilizes a 'ClickFix' social engineering lure that triggers a multi-stage execution chain, eventually sideloading the backdoor via a legitimate Microsoft Defender executable (mpextms.exe). The malware is notable for its extensive use of LLVM-based obfuscation, including Mixed Boolean-Arithmetic (MBA) and Control Flow Flattening (CFF), which masks 95% of its code as noise.
Technically, MLTBackdoor is a sophisticated post-exploitation tool capable of performing standard filesystem operations and, more significantly, loading Beacon Object Files (BOFs) to dynamically extend its functionality. It employs a custom encrypted binary protocol over TLS and a date-based Domain Generation Algorithm (DGA) to ensure resilient Command and Control (C2) connectivity even if hardcoded domains are neutralized.
This threat poses a significant risk to organizations as it is specifically designed to bypass modern security controls through indirect system calls (Hell's Gate technique) and aggressive anti-analysis checks that verify the environment for virtualization, sandboxing, or debugging tools before fully engaging.