Fast Facts
- Attackers use a multi-stage chain involving a Go-based loader (HollowFrame) and Rust-based backdoor (Matryoshka) to establish persistent remote access, bypassing defenses.
- The campaign begins with spear-phishing utilizing encrypted archives and malicious LNK files disguised as legal documents, triggering privilege escalation and payload downloads.
- Command and control are managed via HTTP and a private GitHub repository, enabling covert endpoint management, data exfiltration, and stealthy lateral movement.
Threat, Attack Techniques, and Targets
Cybersecurity experts have identified a new threat involving the HollowFrame Loader and the Matryoshka backdoor. HollowFrame is a loader written in Go and operates as a modular framework. It supports different methods to load malicious components and avoids detection by checking system environment details. The attack begins with a spear-phishing email. The message contains a link to an encrypted archive with a Windows Shortcut (LNK) file. The LNK file appears as “Case Documents” to trick victims. When opened, it executes a PowerShell script that downloads further malicious payloads from a remote server.
HollowFrame uses a legitimate Python binary paired with a malicious DLL (“python311.dll”) for side-loading. Once activated, it unpacks an encrypted container that launches a second loader, which deploys the Rust-based backdoor called Matryoshka. Matryoshka communicates with its command-and-control (C2) servers over HTTP and uses a GitHub repository for tasking and data exchange. The goal of this attack is to gain remote control, perform network reconnaissance, and move laterally within the network.
The attack targeted two endpoints at an unspecified law firm. This suggests that the threat actors focus on legal organizations and their sensitive data. The attack also involves techniques like privilege escalation, bypassing Microsoft Defender protections, and establishing persistence through scheduled tasks.
Impact, Security Implications, and Remediation Guidance
This multi-stage attack can have serious consequences. The threat allows the attacker to maintain control over compromised systems for long periods. They can conduct reconnaissance, steal credentials, transfer files, and deploy additional malicious tools. Such activity puts sensitive legal information and client confidentiality at risk. The use of layered malware components makes detection harder and increases the potential for lateral movement within the network.
Because the attack involves complex methods like anti-analysis checks and remote command execution, organizations need to be vigilant. The use of GitHub for command-and-control also implies that attacker-controlled repositories can be hidden among legitimate ones, increasing the challenge of detection.
For remediation, organizations should consult the guidance provided by their security vendors or cybersecurity authorities. Immediate steps may include scanning for the malicious LNK files, monitoring for unusual PowerShell activity, and checking for the presence of the known malware components. Additionally, reviewing and strengthening endpoint security measures, especially protections against DLL side-loading, can help prevent similar attacks. Always ensure your security tools are up to date and conduct regular security audits to detect this kind of threat early.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Access comprehensive resources on technology by visiting Wikipedia.
ThreatIntel-V1
