Full Report
Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka. According to Blackpoint Cyber, the intrusion sequence begins with a spear-phishing message containing a link to an encrypted archive, which holds a Windows Shortcut (LNK). Executing the file triggers a multi-stage chain that
Analysis Summary
# Incident Report: HollowFrame Loader and Matryoshka Backdoor Intrusion
## Executive Summary
A law firm was targeted by an undocumented multi-stage malware campaign utilizing the **HollowFrame** Go-based loader and the **Matryoshka** Rust-based backdoor. The attack leveraged spear-phishing and DLL side-loading to gain a persistent foothold, conduct Active Directory reconnaissance, and establish command-and-control (C2) via both direct HTTP and GitHub-based "mailbox" repositories. The intrusion was successfully identified and analyzed by Blackpoint Cyber, preventing broader domain compromise.
## Incident Details
- **Discovery Date:** July 31, 2026 (Report Publication)
- **Incident Date:** Active June – July 2026
- **Affected Organization:** Unspecified Law Firm
- **Sector:** Legal
- **Geography:** Undisclosed
## Timeline of Events
### Initial Access
- **Date/Time:** Circa June 2026
- **Vector:** Spear-phishing email
- **Details:** Attackers sent a message containing a link to an encrypted archive. Inside the archive was a Windows Shortcut (LNK) file named "Case Documents."
### Lateral Movement
- **Details:** The Matryoshka backdoor provided capabilities for Active Directory reconnaissance and the delivery of follow-on tooling. While full lateral movement was not detailed, the toolset was specifically designed to support credential theft and domain-wide compromise.
### Data Exfiltration/Impact
- **Details:** The threat actors established file transfer capabilities and per-host "mailboxes" on GitHub to upload stolen data and download malicious tasks.
### Detection & Response
- **Discovery:** Detected by Blackpoint Cyber during monitoring of endpoint activities.
- **Response:** Researchers analyzed the multi-stage chain, identified the C2 infrastructure, and mapped the GitHub-based C2 mechanism used for tasking.
## Attack Methodology
- **Initial Access:** Spear-phishing via encrypted archives and malicious LNK files.
- **Persistence:** Creation of scheduled tasks; use of HollowFrame as a persistent framework.
- **Privilege Escalation:** Multi-stage chain triggered via LNK execution.
- **Defense Evasion:**
- DLL Side-loading (using legitimate `python.exe` to load rogue `python311.dll`).
- Anti-analysis checks: System uptime, memory capacity, file count, and cursor movement.
- Weakening Microsoft Defender protections.
- Living-off-the-land (LotL) using PowerShell.
- **Credential Access:** Supported via secondary payloads delivered by Matryoshka.
- **Discovery:** Active Directory reconnaissance; system environment checks.
- **Lateral Movement:** Supported by modular tool delivery.
- **Collection:** Per-host "mailbox" directories on GitHub for staging data.
- **Exfiltration:** HTTP-based file transfers and GitHub repository uploads.
- **Impact:** Remote command execution and potential for full domain compromise.
## Impact Assessment
- **Financial:** Not disclosed; potential for high costs associated with legal data breaches.
- **Data Breach:** Risk of sensitive client case documents and Active Directory credentials.
- **Operational:** Disruption to two specific law firm endpoints.
- **Reputational:** High risk due to the sensitive nature of the legal industry.
## Indicators of Compromise
- **Network Indicators:**
- `2.26.252[.]84` (Payload hosting)
- `45.158.196[.]184[:]8888` (HTTP C2)
- `github[.]com/adioziaete/memio` (GitHub C2)
- **File Indicators:**
- `python311.dll` (HollowFrame Loader)
- `version.dll` (Matryoshka HTTP variant)
- `wtsapi32.dll` (Matryoshka GitHub variant)
- "Case Documents.lnk"
- **Behavioral Indicators:**
- `python.exe` side-loading unexpected DLLs.
- PowerShell reaching out to external IP addresses for file downloads.
- Unauthorized creation of scheduled tasks.
## Response Actions
- **Containment:** Isolated the two affected endpoints at the law firm.
- **Eradication:** Terminated malicious processes and deleted scheduled tasks.
- **Recovery:** Removed the rogue DLLs and restored Microsoft Defender settings.
## Lessons Learned
- **Detection Gaps:** Single components of this attack (HollowFrame vs. Matryoshka) did not contain the full infection logic, making individual detection difficult without behavioral correlation.
- **Abuse of Trusted Services:** The use of GitHub for C2 allows attackers to blend in with legitimate traffic, bypassing traditional IP-based reputation filters.
## Recommendations
- **Email Security:** Implement stricter filtering for encrypted archives and LNK files from external sources.
- **Endpoint Protection:** Enable "Block Office communication apps from creating child processes" and monitor for unusual DLL side-loading in common binaries like Python.
- **Network Monitoring:** Implement monitoring for unauthorized access to GitHub API endpoints and raw repository traffic from non-developer workstations.
- **User Awareness:** Train staff specifically on the risks of LNK files disguised as "Case Documents" or other industry-specific lures.