HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm

July 31, 2026 · The Hacker News · Severity: HIGH

A previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family named Matryoshka were used in a spear-phishing attack targeting a law firm. The attack began with a phishing email containing a link to an encrypted archive holding a malicious Windows Shortcut (LNK) file disguised as "Case Documents." When executed, the LNK triggered a multi-stage attack chain involving privilege escalation, disabling Microsoft Defender, and downloading additional payloads. HollowFrame leveraged DLL side-loading via a legitimate Python binary, while Matryoshka provided backdoor capabilities, including command execution, file transfer, and reconnaissance. The malware communicated with command-and-control servers (2.26.252.84 and 45.158.196.184:8888) and a private GitHub repository for tasking and payload delivery. The attack specifically targeted two endpoints at the law firm, aiming to establish persistence and enable lateral movement. HollowFrame performed anti-analysis checks to evade detection, while Matryoshka used GitHub as a C2 channel, assigning each victim a unique directory for command execution and data exfiltration. The malware's modular design complicated attribution, as no single component contained the full attack logic. Although the attackers' identity remains unknown, the campaign highlights the growing sophistication of phishing attacks against high-value targets like law firms, where stolen credentials could lead to broader network compromise. The use of GitHub for C2 also demonstrates how attackers abuse legitimate platforms to evade detection.

Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka . According to Blackpoint Cyber, the intrusion sequence begins with a spear-phishing message containing a link to an encrypted archive, which holds a Windows Shortcut (LNK). Executing the file triggers a multi-stage chain that involves privilege escalation, weakening Microsoft Defender protections, and downloading additional payloads. While HollowFrame is launched via a DLL side-loading pair comprising the legitimate Python binary ("python.exe") and a rogue DLL ("python311.dll"), Matryoshka comes in two variants, one which supports HTTP-based communication and command execution, and another that uses GitHub for command-and-control (C2), including beaconing, tasking, reconnaissance, file transfer, and secondary payload delivery. "Together, HollowFrame and Matryoshka gave the actor a persistent foothold for remote command execution, Active Directory reconnaissance, file transfer, and deployment of follow-on tooling," security researchers Nevan Beal and Sam Decker said . "These capabilities could support credential theft, lateral movement, and broader domain compromise through additional tools delivered after initial access." The cybersecurity company said the multi-stage intrusion targeted two endpoints at an unspecified law firm, with the LNK file masquerading as "Case Documents" to trick the recipient into clicking it and activating a command sequence that employs PowerShell to fetch next-stage components from a remote server ("2.26.252[.]84"). HollowFrame operates as a modular loader and persistence framework that supports various methods to load auxiliary components, at the same time performing anti-analysis checks to avoid running within sandboxed environments. This is determined based on system uptime, installed memory, file count in the user profile, and cursor movement. Persistence is achieved by setting up a scheduled task. The Go loader comes embedded with an encrypted container, which is then unpacked to launch a second side-loading chain to deploy Matryoshka ("version.dll"), a Rust-based backdoor that communicates with its C2 server ("45.158.196[.]184:8888") over HTTP to spawn a shell and deliver additional tooling. A second DLL ("wtsapi32.dll") recovered in connection with the same activity has been flagged as a variant of Matryoshka that makes use of a private GitHub repository (" adioziaete /memio") to poll victim-specific commands, submit results, and fetch payloads. "The repository functioned as a collection of per-host mailboxes, with each victim assigned a dedicated <computer>_<username> directory," Blackpoint explained. "These directories contained beacon.json, cmd.json, result.json, and, in some cases, an upload/ tree for file delivery." "This structure allowed the operator to manage tasking and results for individual endpoints through GitHub without maintaining a custom command server, while also leaving a versioned history of repository changes unless the associated commits or repository were removed." Querying the GitHub API with the username shows that the account was created on January 6, 2023, and that the profile information was updated as recently as June 7, 2026. It's currently not known who is behind the activity. "Across the chain, each stage reduced the amount of malicious behavior visible in the stage before it," Blackpoint noted. "That separation complicated attribution and detection because no single component contained the full infection logic or complete C2 picture." Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Key Takeaways

Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame.
"Together, HollowFrame and Matryoshka gave the actor a persistent foothold for remote command execution, Active.
This is determined based on system uptime, installed memory, file count in the user profile, and cursor movement.