MLTBackdoor (Backdoor.Mistic): KongTuke-Linked Windows Backdoor Delivered via ClickFix and mpextms.exe DLL Sideloading — Threadlinqs Intelligence
As of 2026-08-27, MLTBackdoor (Backdoor.Mistic): KongTuke-Linked Windows Backdoor Delivered via ClickFix and mpextms.exe DLL Sideloading is a high-severity malware threat attributed to KongTuke, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-2163 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: KongTuke · FINANCIAL
Zscaler ThreatLabz and Symantec/Broadcom independently documented MLTBackdoor (aka Backdoor.Mistic), a custom Windows backdoor delivered through ClickFix-style copy-paste lures on automotive-themed
MLTBackdoor was first identified by Zscaler ThreatLabz in May 2026 and publicly detailed on June 9, 2026 in "Technical Analysis of MLTBackdoor." Infection begins with a ClickFix lure on an automotive-themed webpage that instructs victims to copy and paste a command into a Run/terminal prompt: a headless conhost.exe invokes cmd /c to create a working folder, curl-download a TAR archive from a DGA-generated domain, extract it, and execute `rundll32 endpointdlp.dll,#2`. The archive contains `endpointdlp.dll` and an RC4-encrypted `data.bin`; the DLL decrypts `data.bin` (4-byte size + 32-byte key header) to reveal the MLTBackdoor payload. Persistence and re-infection are achieved by sideloading `endpointdlp.dll` through the legitimate Microsoft Defender component `mpextms.exe`, including for the malware's self-update mechanism.
The backdoor is heavily obfuscated: Mixed Boolean-Arithmetic (MBA) rewrites simple arithmetic into large chains of equivalent noise operations (Zscaler estimates ~95% of code is such filler), control-flow flattening replaces branching logic with a single dispatcher `while(1){switch(state)}` loop with XOR'd state values, and strings are built byte-by-byte on the stack at runtime. Win32 APIs and system calls are resolved via DJB2 hashing, and 31 Nt* functions are called indirectly (Hell's Gate) to defeat usermode API hooking. On startup the malware runs a 10-flag anti-analysis bitmask check covering hypervisor/sandbox-driver detection, RDTSC timing checks, `NtQueryInformationProcess`-based debugger detection, SHA256 comparison against 30+ known analysis-tool binaries, analysis-tool window-title enumeration, and low RAM/CPU-count/uptime sandbox heuristics; results are reported to the C2 in the initial handshake.
Command-and-control runs over TLS on port 443 to path `/api/v1/telemetry`, spoofing the User-Agent `Microsoft-Delivery-Optimization/10.1`. Session keys are derived from an ECDH (NIST P-256) key exchange — `SHA256(ECDH_secret || client_pubkey || server_pubkey)` seeds an AES-256-GCM channel — wrapped in a custom packet format (magic `0x014D4C54`/"MLT", session ID, message type, nonce, GCM tag). Supported message types include check-in, sleep, exit, file download/upload/listing/delete/rename/mkdir, and loading of Beacon Object Files (MS-COFF, Cobalt Strike BOF-API compatible, with indirect-syscall Beacon wrappers), letting operators extend capability in-memory without dropping new binaries. A deterministic, date-based DGA generates one fallback domain per day (e.g. `rs2y15sungu.com` on April 29, 2026, which doubled as both a payload-distribution and C2 domain) so the operator retains control if hardcoded C2 (`carrolc.com`, `cwrtwright.com`, `thomphon.com`) is taken down.
Symantec/Broadcom's Threat Hunter Team (June 24, 2026) and The Hacker News (June 25, 2026) independently tied the same tooling — tracked by Symantec as Backdoor.Mistic — to the financially motivated initial access broker KongTuke (aka Woodgnat, active since roughly May 2024), noting it is deployed alongside ModeloRAT, a WinPython-packaged Python RAT also attributed to the group, and that KongTuke's ClickFix/FileFix/CrashFix lure infrastructure has been used against insurance, education, IT-services, and professional-services organizations with no specific geographic restriction. KongTuke is described as establishing durable remote access footholds for resale to ransomware affiliates rather than deploying ransomware itself, with publicly reported downstream links to Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta operations. No CVE applies — this is a post-exploitation/access tool delivered via social engineering and abuse of a legitimate signed binary, not a software vulnerability.
Target sectors: insurance, education, it services, professional services
Target regions: Global
Timeline
- KongTuke (aka Woodgnat) initial access broker activity reported as active from approximately May 2024.
- DGA-generated domain rs2y15sungu.com used simultaneously for MLTBackdoor payload distribution and C2.
- MLTBackdoor first identified and tracked by Zscaler ThreatLabz.
- Zscaler ThreatLabz publishes "Technical Analysis of MLTBackdoor," detailing the ClickFix chain, DLL sideloading, C2 protocol, and DGA.
- Symantec/Broadcom Threat Hunter Team publishes analysis tracking the same malware as Backdoor.Mistic and attributing it to KongTuke alongside ModeloRAT.
- The Hacker News reports on the Mistic backdoor's link to KongTuke and its use in ClickFix and ModeloRAT campaigns.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1204, T1059, T1218, T1574, T1036, T1027, T1622, T1497, T1620, T1518
