Hollow Frame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm
Summary: Blackpoint Cyber researchers documented a Go-based loader called HollowFrame and a Rust-based backdoor called Matryoshka, deployed in a spear-phishing attack that targeted two endpoints at an unspecified law firm. The chain began with a link to an encrypted archive containing a Windows Shortcut disguised as "Case Documents," which used PowerShell to fetch payloads from 2.26.252[.]84, escalated privileges, weakened Microsoft Defender, and side-loaded HollowFrame via python.exe and a rogue python311.dll before deploying Matryoshka for HTTP command-and-control at 45.158.196[.]184:8888 or, in a second variant, through a private GitHub repository named adioziaete/memio.
What's compelling: The GitHub variant turned a private repository into per-host mailboxes - beacon.json, cmd.json, result.json - so the operator managed tasking without a custom command server, and the repository retains a versioned history of those changes unless the commits or repo are removed. Each stage hid the malicious behavior of the one before it, so no single component held the full infection logic or complete C2 picture, which is what complicated both attribution and detection.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026