Blackpoint Cyber, a cybersecurity company, discovered and analyzed the HollowFrame loader and Matryoshka backdoor used in a spear-phishing campaign against a law firm. Their research detailed the multi-stage attack chain, including DLL side-loading, anti-analysis checks, and dual C2 mechanisms. The findings highlight the complexity and stealth of the intrusion, which targeted two endpoints.