HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm
Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka. According to Blackpoint Cyber, the intrusion sequence begins with a spear-phishing message containing…
Intelligence analysis by Llama
A previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka have been discovered. The intrusion sequence begins with a spear-phishing message containing a link to an encrypted archive, which holds a Windows Shortcut (LNK).
Imagine you receive an email with a link to a file that looks like a document. But when you click on it, it secretly installs a program on your computer that lets the bad guys control it remotely. This is what happened in a recent cyber attack where the attackers used a program called HollowFrame to install a backdoor called Matryoshka. The backdoor lets the attackers access your computer and steal your information.
Analysis
A Persistent Foothold for Remote Command Execution
The discovery of HollowFrame and Matryoshka has shed light on a sophisticated intrusion sequence that begins with a spear-phishing message containing a link to an encrypted archive, which holds a Windows Shortcut (LNK). This multi-stage chain involves privilege escalation, weakening Microsoft Defender protections, and downloading additional payloads. The Go-based loader framework, HollowFrame, operates as a modular loader and persistence framework that supports various methods to load auxiliary components, performing anti-analysis checks to avoid running within sandboxed environments. Persistence is achieved by setting up a scheduled task. The Rust-based backdoor, Matryoshka, communicates with its C2 server over HTTP to spawn a shell and deliver additional tooling. A second DLL recovered in connection with the same activity has been flagged as a variant of Matryoshka that makes use of a private GitHub repository to poll victim-specific commands, submit results, and fetch payloads. The repository functioned as a collection of per-host mailboxes, with each victim assigned a dedicated computer_username directory. These directories contained beacon.json, cmd.json, result.json, and, in some cases, an upload/ tree for file delivery. This structure allowed the operator to manage tasking and results for individual endpoints through GitHub without maintaining a custom command server, while also leaving a versioned history of repository changes unless the associated commits or repository were removed. Querying the GitHub API with the username shows that the account was created on January 6, 2023, and that the profile information was updated as recently as June 7, 2026. It's currently not known who is behind the activity. Across the chain, each stage reduced the amount of malicious behavior visible in the stage before it, complicating attribution and detection because no single component contained the full infection logic or complete C2 picture.
Key points
- HollowFrame is a previously undocumented Go-based loader framework.
- Matryoshka is a Rust-based malware family tracked as a backdoor.
- The intrusion sequence begins with a spear-phishing message containing a link to an encrypted archive, which holds a Windows Shortcut (LNK).
- The multi-stage chain involves privilege escalation, weakening Microsoft Defender protections, and downloading additional payloads.
- HollowFrame operates as a modular loader and persistence framework that supports various methods to load auxiliary components.
The discovery of HollowFrame and Matryoshka highlights the evolving tactics of cyber attackers and the need for robust security measures to prevent such attacks. It also underscores the importance of staying vigilant and adapting to new threats. With the right security measures in place, organizations can protect themselves against such attacks and prevent the loss of sensitive information.
The use of HollowFrame and Matryoshka demonstrates the sophistication and adaptability of cyber attackers. The fact that these tools are designed to evade detection and persist on a system for an extended period makes them particularly concerning. If left unchecked, these types of attacks could lead to significant data breaches and compromise sensitive information.
