HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm

Published:

31 juli 2026 om 16:39:31

Alert date:

31 juli 2026 om 18:01:57

Source:

thehackernews.com

Ransomware & Malware, Email & Messaging, Identity & Access, Data Breach & Exfiltration

Cybersecurity researchers at Blackpoint Cyber have uncovered a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka. The attack targets law firms via spear-phishing emails containing links to encrypted archives holding Windows Shortcut (LNK) files. Executing the LNK file triggers a multi-stage infection chain ultimately deploying the Matryoshka backdoor. The use of both Go and Rust-based components suggests a sophisticated threat actor with development resources. The campaign demonstrates targeted intent given the spear-phishing approach directed at legal sector organizations. The multi-stage loader design is consistent with modern evasion techniques to bypass endpoint detection. The Matryoshka name likely reflects the nested, layered nature of the malware's execution chain.

Technical details

The attack begins with a spear-phishing message containing a link to an encrypted archive holding a Windows Shortcut (LNK) file masquerading as 'Case Documents'. Executing the LNK triggers a multi-stage infection chain: (1) PowerShell fetches next-stage components from remote server 2.26.252[.]84; (2) HollowFrame, a Go-based modular loader, is deployed via DLL side-loading using a legitimate Python binary ('python.exe') and a rogue DLL ('python311.dll'); (3) HollowFrame performs anti-analysis checks based on system uptime, installed memory, file count in user profile, and cursor movement to avoid sandbox detection; (4) HollowFrame establishes persistence via a scheduled task; (5) HollowFrame contains an encrypted embedded container that unpacks and launches a second side-loading chain to deploy Matryoshka ('version.dll'), a Rust-based backdoor; (6) Matryoshka communicates over HTTP with C2 server 45.158.196[.]184:8888 to spawn a shell and deliver additional tooling; (7) A second Matryoshka variant ('wtsapi32.dll') uses a private GitHub repository ('adioziaete/memio') for C2, polling victim-specific commands, submitting results, and fetching payloads; (8) The GitHub repository functioned as per-host mailboxes with directories named <computer>_<username> containing beacon.json, cmd.json, result.json, and an upload/ tree. The layered design ensured no single component contained the full infection logic, complicating attribution and detection. Capabilities include remote command execution, Active Directory reconnaissance, file transfer, credential theft, lateral movement, and broader domain compromise. The GitHub account 'adioziaete' was created on January 6, 2023, and last updated June 7, 2026.

Mitigation steps:

1. Block network connections to known malicious IPs: 2.26.252[.]84 and 45.158.196[.]184:8888. 2. Monitor and block outbound connections to github.com/adioziaete and the repository adioziaete/memio. 3. Inspect and alert on DLL side-loading patterns, particularly involving python.exe with unexpected python311.dll, version.dll, or wtsapi32.dll in non-standard directories. 4. Hunt for scheduled tasks created by unusual or non-standard processes as a persistence indicator. 5. Monitor PowerShell execution downloading remote payloads, especially from unknown IPs. 6. Strengthen email security to detect and block spear-phishing messages containing links to encrypted archives with LNK files. 7. Educate users to avoid clicking LNK files delivered via email or external links, especially those labeled as 'Case Documents'. 8. Ensure Microsoft Defender and other endpoint protection tools are fully enabled and monitor for attempts to weaken or disable them. 9. Monitor Active Directory for unusual reconnaissance activity (e.g., LDAP queries from unexpected hosts or users). 10. Review and restrict privilege escalation paths on endpoints. 11. Implement application whitelisting to prevent unauthorized DLL loading. 12. Monitor GitHub API usage and outbound HTTPS traffic to github.com from endpoints for anomalous patterns. 13. Review sandbox evasion indicators (system uptime checks, memory checks, cursor movement monitoring) in endpoint detection rules.

Affected products:

Microsoft Windows (LNK/Shortcut execution)
Microsoft Defender (targeted for weakening)
Python runtime (python.exe / python311.dll used for DLL side-loading)
Active Directory (targeted for reconnaissance)
GitHub (abused as C2 infrastructure)