Security researchers at Blackpoint Cyber have documented a new multi-stage attack chain that hit at least one law firm, introducing two previously unknown malware families: a Go-based loader called HollowFrame and a Rust-based backdoor called Matryoshka. The intrusion begins with a spear-phishing message containing a link to an encrypted archive. Inside is a Windows Shortcut (LNK) file disguised as “Case Documents” — a lure specifically crafted for a legal target. Clicking the shortcut triggers a PowerShell command that fetches next-stage payloads from a remote server, escalates privileges, weakens Microsoft Defender protections, and sets up a scheduled task for persistence.
HollowFrame runs through DLL side-loading, hijacking the legitimate Python binary (python.exe) by swapping in a rogue python311.dll. The loader performs anti-analysis checks based on system uptime, installed RAM, file count in the user profile, and cursor movement — all signals used to detect sandbox environments. Once HollowFrame is satisfied it is running on a real system, it decrypts an embedded container and launches Matryoshka. The Rust-based backdoor communicates with a hardcoded command-and-control server over HTTP to receive commands, spawn a shell, and pull in additional tooling. A second Matryoshka variant recovered from the same operation uses a private GitHub repository — with per-victim directories named <computer>_<username> — to poll for commands and submit results, making the C2 traffic appear indistinguishable from ordinary GitHub API calls. Blackpoint noted the combined capabilities — remote command execution, Active Directory reconnaissance, file transfer, and secondary payload delivery — are sufficient for credential theft, lateral movement, and broad domain compromise.