# MLTBackdoor (Backdoor.Mistic): KongTuke-Linked Windows Backdoor Delivered via ClickFix and mpextms.exe DLL Sideloading

> Zscaler ThreatLabz and Symantec/Broadcom independently documented MLTBackdoor (aka Backdoor.Mistic), a custom Windows backdoor delivered through ClickFix-style copy-paste lures on automotive-themed pages and sideloaded via the legitimate Microsoft Defender binary mpextms.exe. The malware uses heavy anti-analysis obfuscation, a custom ECDH/AES-GCM encrypted C2 protocol over TLS, a date-based domain generation algorithm, and a Cobalt Strike-compatible Beacon Object File loader. Both vendors assess it is operated by the financially motivated initial access broker KongTuke (aka Woodgnat), which resells footholds to ransomware affiliates including Qilin, Akira, Rhysida, Black Basta, Interlock, and 8Base.

- **Published:** 2026-08-27T00:00:00Z
- **Last reviewed:** 2026-08-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2163
- **ID:** TL-2026-2163
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** KongTuke
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

MLTBackdoor was first identified by Zscaler ThreatLabz in May 2026 and publicly detailed on June 9, 2026 in "Technical Analysis of MLTBackdoor." Infection begins with a ClickFix lure on an automotive-themed webpage that instructs victims to copy and paste a command into a Run/terminal prompt: a headless conhost.exe invokes cmd /c to create a working folder, curl-download a TAR archive from a DGA-generated domain, extract it, and execute `rundll32 endpointdlp.dll,#2`. The archive contains `endpointdlp.dll` and an RC4-encrypted `data.bin`; the DLL decrypts `data.bin` (4-byte size + 32-byte key header) to reveal the MLTBackdoor payload. Persistence and re-infection are achieved by sideloading `endpointdlp.dll` through the legitimate Microsoft Defender component `mpextms.exe`, including for the malware's self-update mechanism.

The backdoor is heavily obfuscated: Mixed Boolean-Arithmetic (MBA) rewrites simple arithmetic into large chains of equivalent noise operations (Zscaler estimates ~95% of code is such filler), control-flow flattening replaces branching logic with a single dispatcher `while(1){switch(state)}` loop with XOR'd state values, and strings are built byte-by-byte on the stack at runtime. Win32 APIs and system calls are resolved via DJB2 hashing, and 31 Nt* functions are called indirectly (Hell's Gate) to defeat usermode API hooking. On startup the malware runs a 10-flag anti-analysis bitmask check covering hypervisor/sandbox-driver detection, RDTSC timing checks, `NtQueryInformationProcess`-based debugger detection, SHA256 comparison against 30+ known analysis-tool binaries, analysis-tool window-title enumeration, and low RAM/CPU-count/uptime sandbox heuristics; results are reported to the C2 in the initial handshake.

Command-and-control runs over TLS on port 443 to path `/api/v1/telemetry`, spoofing the User-Agent `Microsoft-Delivery-Optimization/10.1`. Session keys are derived from an ECDH (NIST P-256) key exchange — `SHA256(ECDH_secret || client_pubkey || server_pubkey)` seeds an AES-256-GCM channel — wrapped in a custom packet format (magic `0x014D4C54`/"MLT", session ID, message type, nonce, GCM tag). Supported message types include check-in, sleep, exit, file download/upload/listing/delete/rename/mkdir, and loading of Beacon Object Files (MS-COFF, Cobalt Strike BOF-API compatible, with indirect-syscall Beacon wrappers), letting operators extend capability in-memory without dropping new binaries. A deterministic, date-based DGA generates one fallback domain per day (e.g. `rs2y15sungu.com` on April 29, 2026, which doubled as both a payload-distribution and C2 domain) so the operator retains control if hardcoded C2 (`carrolc.com`, `cwrtwright.com`, `thomphon.com`) is taken down.

Symantec/Broadcom's Threat Hunter Team (June 24, 2026) and The Hacker News (June 25, 2026) independently tied the same tooling — tracked by Symantec as Backdoor.Mistic — to the financially motivated initial access broker KongTuke (aka Woodgnat, active since roughly May 2024), noting it is deployed alongside ModeloRAT, a WinPython-packaged Python RAT also attributed to the group, and that KongTuke's ClickFix/FileFix/CrashFix lure infrastructure has been used against insurance, education, IT-services, and professional-services organizations with no specific geographic restriction. KongTuke is described as establishing durable remote access footholds for resale to ransomware affiliates rather than deploying ransomware itself, with publicly reported downstream links to Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta operations. No CVE applies — this is a post-exploitation/access tool delivered via social engineering and abuse of a legitimate signed binary, not a software vulnerability.

## MITRE ATT&CK

- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1218 System Binary Proxy Execution
- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1622 Debugger Evasion
- T1497 Virtualization/Sandbox Evasion
- T1620 Reflective Code Loading
- T1518 Software Discovery
- T1010 Application Window Discovery
- T1082 System Information Discovery
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1568 Dynamic Resolution

## Sources

- [Technical Analysis of MLTBackdoor](https://www.zscaler.com/blogs/security-research/technical-analysis-mltbackdoor)
- [New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Campaigns](https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html)
- [Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker](https://www.security.com/threat-intelligence/new-mistic-backdoor-modelorat)
- [Hackers Deploy MLTBackdoor Malware via Multi-Stage ClickFix Infection Chain](https://cybersecuritynews.com/hackers-deploy-mltbackdoor-malware/amp/)
- [Hackers Use ClickFix Chain to Deploy MLTBackdoor Malware](https://gbhackers.com/mltbackdoor-malware/)
- [MLTBackdoor Uses ClickFix Lures and DLL Sideloading to Evade Analysis](https://www.mallory.ai/stories/019ead5a-a99d-73b9-8ef0-e890245d0ee2)
- [User Execution: Malicious Copy and Paste, Sub-technique T1204.004](https://attack.mitre.org/techniques/T1204/004/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2163