MLTBackdoor was first identified by Zscaler ThreatLabz in May 2026 and publicly detailed on June 9, 2026 in "Technical Analysis of MLTBackdoor." Infection begins with a ClickFix lure on an automotive-themed webpage that instructs victims to copy and paste a command into a Run/terminal prompt: a headless conhost.exe invokes cmd /c to create a working folder, curl-download a TAR archive from a DGA-generated domain, extract it, and execute `rundll32 endpointdlp.dll,#2`. The archive contains `endpointdlp.dll` and an RC4-encrypted `data.bin`; the DLL decrypts `data.bin` (4-byte size + 32-byte key header) to reveal the MLTBackdoor payload. Persistence and re-infection are achieved by sideloading `endpointdlp.dll` through the legitimate Microsoft Defender component `mpextms.exe`, including for the malware's self-update mechanism.

The backdoor is heavily obfuscated: Mixed Boolean-Arithmetic (MBA) rewrites simple arithmetic into large chains of equivalent noise operations (Zscaler estimates ~95% of code is such filler), control-flow flattening replaces branching logic with a single dispatcher `while(1){switch(state)}` loop with XOR'd state values, and strings are built byte-by-byte on the stack at runtime. Win32 APIs and system calls are resolved via DJB2 hashing, and 31 Nt* functions are called indirectly (Hell's Gate) to defeat usermode API hooking. On startup the malware runs a 10-flag anti-analysis bitmask check covering hypervisor/sandbox-driver detection, RDTSC timing checks, `NtQueryInformationProcess`-based debugger detection, SHA256 comparison against 30+ known analysis-tool binaries, analysis-tool window-title enumeration, and low RAM/CPU-count/uptime sandbox heuristics; results are reported to the C2 in the initial handshake.

Command-and-control runs over TLS on port 443 to path `/api/v1/telemetry`, spoofing the User-Agent `Microsoft-Delivery-Optimization/10.1`. Session keys are derived from an ECDH (NIST P-256) key exchange — `SHA256(ECDH_secret || client_pubkey || server_pubkey)` seeds an AES-256-GCM channel — wrapped in a custom packet format (magic `0x014D4C54`/"MLT", session ID, message type, nonce, GCM tag). Supported message types include check-in, sleep, exit, file download/upload/listing/delete/rename/mkdir, and loading of Beacon Object Files (MS-COFF, Cobalt Strike BOF-API compatible, with indirect-syscall Beacon wrappers), letting operators extend capability in-memory without dropping new binaries. A deterministic, date-based DGA generates one fallback domain per day (e.g. `rs2y15sungu.com` on April 29, 2026, which doubled as both a payload-distribution and C2 domain) so the operator retains control if hardcoded C2 (`carrolc.com`, `cwrtwright.com`, `thomphon.com`) is taken down.

Symantec/Broadcom's Threat Hunter Team (June 24, 2026) and The Hacker News (June 25, 2026) independently tied the same tooling — tracked by Symantec as Backdoor.Mistic — to the financially motivated initial access broker KongTuke (aka Woodgnat, active since roughly May 2024), noting it is deployed alongside ModeloRAT, a WinPython-packaged Python RAT also attributed to the group, and that KongTuke's ClickFix/FileFix/CrashFix lure infrastructure has been used against insurance, education, IT-services, and professional-services organizations with no specific geographic restriction. KongTuke is described as establishing durable remote access footholds for resale to ransomware affiliates rather than deploying ransomware itself, with publicly reported downstream links to Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta operations. No CVE applies — this is a post-exploitation/access tool delivered via social engineering and abuse of a legitimate signed binary, not a software vulnerability.