Published on August 3, 2026
HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm
Severity
Medium
Detail
Cybersecurity researchers have identified a previously undocumented attack framework involving a Go-based loader called HollowFrame and a Rust-based backdoor named Matryoshka. The malware was observed in a targeted intrusion against a law firm, where it was used to establish persistent remote access, perform reconnaissance, and deliver additional payloads.
The campaign demonstrates a highly modular attack chain designed to minimize detection by separating malicious functionality across multiple stages.
How?
The attack begins with a spear-phishing email containing a link to an encrypted archive that includes a malicious Windows Shortcut (LNK) file disguised as “Case Documents.” When executed, the shortcut launches PowerShell commands that download additional components from an attacker-controlled server.
The malware then uses DLL sideloading with a legitimate Python executable (python.exe) and a malicious python311.dll to launch HollowFrame. Before continuing, the loader performs anti-analysis checks by examining factors such as system uptime, available memory, user activity, and file counts to avoid running in sandboxed or virtual environments. It also establishes persistence through a scheduled task while weakening Microsoft Defender protections.
HollowFrame subsequently decrypts and deploys Matryoshka, a Rust-based backdoor that provides remote command execution, file transfer, and system reconnaissance. One variant communicates with its command-and-control (C2) server over HTTP, while another abuses a private GitHub repository as its C2 infrastructure, using victim-specific directories to receive commands, upload results, and deliver additional payloads.
This modular design enables attackers to perform Active Directory reconnaissance, deploy follow-on malware, and potentially facilitate credential theft and lateral movement across the network.
Conclusion
The HollowFrame and Matryoshka attack chain highlights how modern threat actors are adopting modular malware architectures, anti-analysis techniques, and trusted platforms such as GitHub to reduce detection and maintain long-term access to compromised environments. By separating each stage of the infection, the attackers make incident response and attribution significantly more challenging.
Organizations should strengthen email security to defend against spear-phishing attacks, monitor for suspicious PowerShell execution and DLL sideloading activity, detect unauthorized scheduled task creation, and inspect outbound connections to unusual HTTP endpoints or GitHub repositories. Continuous monitoring for abnormal process behavior and follow-on payload delivery is also essential to detecting multi-stage intrusions like HollowFrame and Matryoshka.
Source
https://thehackernews.com/2026/07/hollowframe-loader-deploys-matryoshka.html