In the rapidly shifting landscape of enterprise cyber threats, sophisticated threat actors continuously re-engineer their codebases to bypass contemporary Endpoint Detection and Response (EDR) platforms. In May 2026, security researchers at Zscaler ThreatLabz identified a highly sophisticated, newly uncovered malware family tracked as MLTBackdoor. Attributed with high confidence to a ransomware-aligned threat group, this implant represents a shift toward evasive, modular post-exploitation design. Rather than relying on bloated, signature-heavy frameworks, MLTBackdoor uses advanced compile-time obfuscation, custom network telemetry, and an in-memory execution pipeline designed to grant attackers stealthy infrastructure control.

The Multi-Stage Delivery Architecture and DLL Sideloading

The threat vector initiates via a highly targeted social engineering mechanism known as a ClickFix campaign. Disguised as legitimate user prompts hosted on compromised, automotive-themed websites, victims are manipulated into executing malicious commands. These commands deploy a stealthy conhost.exe wrapper that silently communicates with a Domain Generation Algorithm (DGA) infrastructure to fetch a highly compressed, hidden archive. Inside this archive sits a multi-stage loading mechanism designed to exploit the operating system’s internal library discovery rules through classic execution hijacking.

Once the archive is extracted, the initial staging component, named endpointdlp.dll, acts as an automated unpacking utility. It locates and decrypts a raw, RC4-encrypted payload embedded within the local directory, which contains the core MLTBackdoor machine code. To execute this code without triggering behavioral alarms, the malware relies on DLL Sideloading. It drops a trusted, cryptographically signed Microsoft Defender binary (mpextms.exe) into the directory alongside the newly decrypted endpointdlp.dll. When mpextms.exe is called, it inherently trusts and loads the malicious DLL due to standard Windows search order priorities, effectively shielding the payload’s bootstrap process inside a legitimate, trusted system process.

Anti-Analysis Controls and Advanced Compile-Time Obfuscation

To severely degrade the capabilities of security researchers and automated sandbox pipelines, the developers of MLTBackdoor utilized an advanced LLVM-based compiler toolchain at build time. This toolchain infuses the code with aggressive Control Flow Flattening (CFF) and Mixed Boolean-Arithmetic (MBA). Control flow flattening completely restructures the binary’s basic blocks, removing natural loops and conditional jumps, and placing them inside a massive switch-case statement governed by a central state variable. To compound this complexity, MLTBackdoor stores this state value at a specific stack offset (rsp+N), applying an XOR modification before every single block comparison, while the logic updating the next state is deeply wrapped in complex MBA math formulas. Consequently, roughly 95% of the compiled binary consists of entirely junk calculations designed to break down automated symbolic execution and exhaust reverse engineers.

Beyond structural flattening, the malware avoids traditional global string tables, which typically serve as immediate indicators of compromise (IoCs) for analysts. Instead, it utilizes Stack Strings, where textual values are constructed at runtime, byte-by-byte, directly inside local stack registers. Furthermore, MLTBackdoor implements a proactive sandbox evasion philosophy. Instead of executing an abrupt termination when it detects an engineering or debugging environment, it runs 10 distinct anti-analysis checks evaluating system virtualization indicators, hypervisor markers, debug registers, and limited hardware resource constraints. The binary aggregates these findings into a unified bitmask array, intentionally keeping the process alive so that it can transmit this environmental telemetry directly back to its operators during the initial handshake.

API Hashing and Hell’s Gate Indirect System Calls

Modern security tools heavily monitor user-mode API calls by placing hooks inside system libraries like ntdll.dll. To bypass this monitoring completely, MLTBackdoor enforces a strict policy of executing user-to-kernel transitions using custom, user-constructed system calls. It achieves this by deploying an architectural adaptation of the Hell’s Gate methodology. During its foundational initialization routine, the backdoor systematically parses the Export Address Table (EAT) of ntdll.dll loaded in memory, hashing the export names dynamically rather than storing them in plain text.

[Target: ntdll Export Table] ➔ [Parse EAT] ➔ [Hash Function] ➔ [Match against 31 "Nt" Hashes] ➔ [Extract SSN] ➔ [Build Direct System Call Table]

The malware maintains a pre-compiled list of 31 cryptographic hashes corresponding to critical “Nt” system procedures. As it walks the export table, it matches the computed hashes against this list to extract the corresponding System Service Numbers (SSNs). Once these indices are collected, MLTBackdoor avoids invoking the APIs normally; instead, it dynamically crafts the necessary machine instructions in memory, loading the SSN directly into the eax register and issuing an indirect system call. This completely blindspots traditional EDR hooks, as the execution stream drops straight into kernel-mode processing without passing through intercepted user-space function entry points.

Command Architecture and In-Memory BOF Dispatcher Workflow

At its functional core, MLTBackdoor functions as a lightweight, highly responsive file-system operator, possessing a native, built-in command array designed for immediate target interaction. The default command suite provides foundational file manipulation capabilities required for staging and lateral discovery.

Command	Action Description	Target Objective
download	Extracts a specified file from the host system	Sensitive data exfiltration
upload	Drops a secondary payload onto the local disk	Post-exploitation expansion
ls	Lists directories and comprehensive file trees	Host environment discovery
delete	Deletes files or folders from the local volume	Event trail and artifact cleanup
rename	Moves or changes filename properties	Structural evasion and cloaking
mkdir	Dynamically provisions a new directory path	Working environment configuration

The implant’s true technical flexibility, however, lies in its modular Beacon Object File (BOF) loader framework. By implementing a custom internal linker-loader capable of parsing unlinked Common Object File Format (COFF) binaries natively in memory, the malware can dynamically inherit complex post-exploitation features (similar to Cobalt Strike tools) without altering its footprint on disk.

Cryptographic Network Communications and C2 Protocol

MLTBackdoor manages command-and-control (C2) operations via a custom binary communications protocol designed to safely blend into legitimate corporate enterprise infrastructure. All outbound traffic flows over standard TLS on port 443, targeting a standardized endpoint path structured as /api/v1/telemetry. To ensure the traffic matches typical application patterns, the network layer explicitly spoofs its header signature by presenting a highly common user agent string: Microsoft-Delivery-Optimization/10.1.

To prevent network defenders from inspecting the data stream via middlebox decryption or proxy appliances, the protocol wraps its payload in a dedicated, custom cryptographic layer. During the initial beaconing phase, the client and C2 perform an ephemeral key exchange, utilizing Elliptic Curve Diffie-Hellman (ECDH) built on the standardized NIST P-256 curve geometry. Once the secret is calculated on both ends, it derives strong, short-lived session keys to encrypt all subsequent communication using AES-256-GCM (Galois/Counter Mode). This architecture guarantees authenticated encryption with absolute forward secrecy, completely locking out network monitoring tools and protocol decoders.

Our Opinion on the MLTBackdoor Paradigm

The emergence of MLTBackdoor underscores a significant paradigm shift in the ransomware initial access landscape. By abandoning traditional, noisy post-exploitation frameworks in favor of a lean, highly custom, and evasive implant, threat actors are adapting directly to modern Endpoint Detection and Response (EDR) realities. The implementation of LLVM-based obfuscation, particularly with 95% of the codebase dedicated to junk Mixed Boolean-Arithmetic and Control Flow Flattening, represents a calculated approach to exhaust human analysts and automated reverse-engineering pipelines alike.

Furthermore, the decision not to immediately terminate upon detecting an analysis sandbox, but instead transmit a 10-check telemetry bitmask, demonstrates sophisticated threat intelligence operationalization. This allows the operators to distinguish between high-value corporate targets and security researchers’ honeypots before executing late-stage modules. Finally, the inclusion of a native Beacon Object File (BOF) loader directly inside a lightweight backdoor minimizes the adversary’s on-disk footprint while providing infinite extensibility. Organizations can no longer rely on static signatures or generic heuristic detections. Defending against such highly resilient, modular threats requires continuous behavioral monitoring, deep memory inspections, and zero-trust network configurations that aggressively flag anomalous outbound TLS telemetry masquerading as legitimate Microsoft infrastructure.