Cybersecurity researchers have identified a new Go-based loader framework named HollowFrame and a Rust-based malware family called Matryoshka, both utilized in a sophisticated spear-phishing attack targeting a law firm.
The attack commenced with a spear-phishing email containing a link to an encrypted archive. This archive housed a Windows Shortcut (LNK) file labeled “Case Documents.” When executed, the LNK file initiated a multi-stage process involving privilege escalation, disabling Microsoft Defender protections, and downloading additional malicious payloads.
HollowFrame is introduced through a DLL side-loading technique, using a legitimate Python executable (“python.exe”) alongside a malicious DLL (“python311.dll”). This loader framework is modular, supporting various methods to load auxiliary components and performing anti-analysis checks to evade detection. These checks assess system uptime, installed memory, file count in the user profile, and cursor movement. Persistence is achieved by creating a scheduled task.
Embedded within HollowFrame is an encrypted container that, once unpacked, initiates another side-loading chain to deploy Matryoshka (“version.dll”). Matryoshka is a Rust-based backdoor that communicates with its command-and-control (C2) server over HTTP, enabling remote command execution, Active Directory reconnaissance, file transfers, and deployment of additional tools.
Another variant of Matryoshka (“wtsapi32.dll”) was discovered, utilizing a private GitHub repository for C2 operations. This variant polls victim-specific commands, submits results, and fetches payloads through the repository. Each victim is assigned a dedicated directory within the repository, containing files such as beacon.json, cmd.json, result.json, and, in some cases, an upload directory for file delivery.
The GitHub account associated with this activity was created on January 6, 2023, with profile information updated as recently as June 7, 2026. The identity of the threat actor remains unknown.
This multi-stage intrusion targeted two endpoints within the law firm. The LNK file’s deceptive labeling as “Case Documents” was designed to entice the recipient into activating a command sequence that employs PowerShell to retrieve next-stage components from a remote server.
The combination of HollowFrame and Matryoshka provided the attacker with a persistent foothold for remote command execution, Active Directory reconnaissance, file transfers, and deployment of additional tools. These capabilities could facilitate credential theft, lateral movement, and broader domain compromise through subsequent tools delivered after initial access.
The use of GitHub for C2 operations highlights the evolving tactics of threat actors, leveraging legitimate platforms to manage tasking and results for individual endpoints without maintaining a custom command server. This approach complicates detection and attribution efforts.
As cyber threats become increasingly sophisticated, organizations must remain vigilant and implement robust security measures to detect and mitigate such multi-stage attacks. Regular employee training on recognizing phishing attempts and maintaining up-to-date security protocols are essential components of a comprehensive defense strategy.
