HollowFrame Loader Drops Matryoshka Backdoor in Law Firm Phishing Attack

Cybersecurity researchers at Blackpoint Cyber have disclosed a targeted spear-phishing campaign against an unspecified law firm that weaponized a previously undocumented Go-based loader called HollowFrame to deliver a Rust-based backdoor tracked as Matryoshka. The intrusion began with a deceptive email linking to an encrypted archive disguised as "Case Documents," which contained a Windows Shortcut (LNK) file. Once executed, the LNK launched a multi-stage chain that included privilege escalation, Microsoft Defender tampering, and the retrieval of follow-on payloads from a remote server at 2.26.252[.]84. Organizations can verify their exposure against similar infrastructure using a WHOIS lookup or port scanner to investigate suspicious communications.

HollowFrame operates as a modular loader and persistence framework triggered through a DLL side-loading pair consisting of the legitimate Python binary ("python.exe") paired with a rogue DLL ("python311.dll"). Before executing its payload, the loader performs multiple anti-analysis checks, examining system uptime, installed memory, file count in the user profile, and cursor movement to avoid sandboxed environments. Persistence is established via a scheduled task, and the Go loader unpacks an encrypted container that initiates a second side-loading chain deploying Matryoshka as "version.dll," which then communicates with its C2 server at 45.158.196[.]184:8888 over HTTP for shell access and additional tooling delivery.

Matryoshka exists in two variants: an HTTP-based version supporting command execution and reconnaissance, and a second variant ("wtsapi32.dll") that uses a private GitHub repository named "adioziaute/memio" for command-and-control operations. According to researchers Nevan Beal and Sam Decker, the repository functioned as per-host mailboxes, with each victim assigned a dedicated _ directory containing beacon.json, cmd.json, result.json, and an optional upload/ tree for file delivery. This dual-variant approach enabled the operator to beacon, task victims, exfiltrate reconnaissance results, and stage secondary payloads, granting a persistent foothold for Active Directory reconnaissance, credential theft, lateral movement, and broader domain compromise. Defenders should audit outbound traffic to uncommon ports and review scheduled tasks regularly to detect this type of stealthy intrusion.

The disclosure underscores how adversaries are blending legitimate binaries, encrypted archives, and abuse of trusted platforms like GitHub to evade traditional defenses. Security teams are advised to enforce strict LNK and archive handling policies, monitor DLL side-loading patterns against signed binaries such as python.exe, and harden endpoint protections beyond default Microsoft Defender configurations. Readers can run a quick privacy checkup to evaluate their current defensive posture against similar threats.