Executive Summary
In May 2026, Zscaler ThreatLabz identified MLTBackdoor, a new post-exploitation framework likely used by ransomware operators to establish persistence and lateral movement. The malware is delivered via 'ClickFix' social engineering lures on compromised web pages, tricking users into executing PowerShell commands that download a multi-stage infection chain. MLTBackdoor is notable for its heavy use of LLVM-based obfuscation, including Mixed Boolean-Arithmetic (MBA) and Control Flow Flattening (CFF), which obscures roughly 95% of its code.
Technically, the backdoor utilizes a custom binary protocol over TLS, a Domain Generation Algorithm (DGA) for resilient command-and-control (C2), and a Beacon Object File (BOF) loader compatible with Cobalt Strike tools. It employs 'Hell's Gate' style indirect system calls to bypass traditional EDR hooks and conducts ten distinct anti-analysis checks, including hypervisor detection and process name hashing, to identify sandboxes and debuggers.
The use of BOFs allows the threat actor to dynamically expand the malware's capabilities without modifying the core binary. Given its association with ransomware campaigns and its high level of technical sophistication, organizations should prioritize detecting the initial ClickFix execution patterns and monitoring for the specific custom network protocol signatures.