HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm

Cybersecurity researchers at Blackpoint Cyber have uncovered a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka. The multi-stage intrusion chain begins with a spear-phishing message containing a link to an encrypted archive, which holds a Windows Shortcut (LNK) masquerading as ‘Case Documents.’

Executing the LNK triggers a command sequence that uses PowerShell to fetch next-stage components from a remote server. HollowFrame is launched via a DLL side-loading pair comprising the legitimate Python binary (python.exe) and a rogue DLL (python311.dll). It operates as a modular loader and persistence framework, performing anti-analysis checks based on system uptime, installed memory, file count in the user profile, and cursor movement. Persistence is achieved by setting up a scheduled task.

Matryoshka comes in two variants: one supports HTTP-based communication and command execution, while the other uses a private GitHub repository (adioziaete/memio) for command-and-control (C2), including beaconing, tasking, reconnaissance, file transfer, and secondary payload delivery. The GitHub-based variant uses per-host mailboxes with directories containing beacon.json, cmd.json, result.json, and an upload/ tree for file delivery.

The attack targeted two endpoints at an unspecified law firm. The C2 servers used were 2.26.252[.]84 and 45.158.196[.]184:8888. The GitHub account was created on January 6, 2023, and updated as recently as June 7, 2026. The attackers remain unidentified.

Blackpoint Cyber noted that each stage reduced the amount of malicious behavior visible in the stage before it, complicating attribution and detection. The combined capabilities could support credential theft, lateral movement, and broader domain compromise.