Technical Analysis of MLTBackdoor

In May 2026 Zscaler ThreatLabz published a technical analysis of MLTBackdoor, a heavily obfuscated Windows backdoor likely used to support ransomware operations; the report covers the ClickFix-based multi-stage infection, RC4-encrypted staged payloads and DLL sideloading, extensive MBA and control-flow flattening obfuscation, API hashing and indirect system calls, multiple anti-analysis checks, a BOF loader for expanding capabilities, and a custom ECDH + AES-256-GCM encrypted protocol over TLS with a date-based DGA for fallback; it also includes sample hashes, C2 domains, and behavioral indicators for detection.