HollowFrame and Matryoshka: a nested law-firm backdoor

Blackpoint Cyber has documented an intrusion on two endpoints at a law firm that combined spear phishing, a Windows shortcut, layered PowerShell, DLL side-loading, a modular Go loader and two Rust backdoors. The newly identified families are named HollowFrame and Matryoshka.

The chain is a useful detection case because almost every stage uses a legitimate mechanism: LNK files, certutil.exe, PowerShell, a genuine python.exe, scheduled tasks and the GitHub API. Malice appears in the sequence and context, not one exotic binary.

The “Case Documents” lure

According to the primary Blackpoint report, a spear-phishing message led to an encrypted archive containing a Windows shortcut masquerading as case documents.

Launching the LNK:

1. wrote Base64 data to %TEMP%\sgrfm.b64;
2. created %TEMP%\sgrfm.cmd;
3. called certutil.exe -decode;
4. started PowerShell;
5. retrieved the next stage from 2.26.252[.]84.

Splitting delivery across LNK, CMD, certutil and PowerShell makes detection tied to one interpreter less reliable.

Obfuscation and a protected lane for malware

The next script stored its payload as a hexadecimal string and decrypted it with a repeating XOR key. It checked for administrator rights and, where needed, requested elevation through -Verb RunAs.

Before downloading executable components, it added Microsoft Defender exclusions for:

• %LOCALAPPDATA%\Programs\Python\Python311-Brief;
• the python.exe process.

Order matters. The actor first created a reduced-inspection zone and only then placed files inside it. Detection focused solely on the later payload may be too late; an unusual process changing Defender exclusions is itself a high-value event.

Python in name only

The script downloaded Python-3.11.0-embed-amd96.zip. The name resembled an official embedded distribution, but the amd96 suffix was unusual. The archive included:

• a legitimate python.exe;
• a malicious python311.dll;
• vcruntime140.dll.

Running python.exe without a script loaded the adjacent library. The DLL was not CPython but a 64-bit Go module exporting the minimum names expected by the host. This is DLL side-loading: a recognisable executable becomes the host for code in a neighbouring library.

HollowFrame: loading and persistence

HollowFrame was a modular Go loader. It checked system uptime, memory, user-profile file count and cursor movement to assess whether it was in a sandbox. It supported multiple component-loading paths and scheduled-task persistence.

Anti-analysis creates its own defensive signals:

• a process reading many environment properties before activity;
• python.exe without expected arguments;
• an adjacent DLL with mismatched provenance;
• Go code executing inside an apparent Python process;
• a task unrelated to legitimate software installation.

Matryoshka: two backdoor variants

Researchers identified two Rust variants:

• one used HTTP communication and command execution;
• the other used GitHub for beaconing, tasking, reconnaissance, file transfer and secondary payload delivery.

GitHub is not malicious, but API traffic from a non-development workstation or server needs an owner and purpose. The campaign used a repository path containing a victim identifier and a User-Agent imitating OneDrive.

Together, HollowFrame and Matryoshka enabled remote command execution, Active Directory reconnaissance, file transfer and follow-on tooling. The report does not confirm domain takeover or theft of client data.

Strong detection points

Correlate the following in a short window:

1. an archive arriving through email or messaging;
2. explorer.exe launching an LNK from downloads;
3. .b64 and .cmd writes under %TEMP%;
4. certutil -decode outside administration;
5. PowerShell with ExecutionPolicy Bypass and a hidden window;
6. Defender exclusion changes;
7. creation of a directory mimicking Python;
8. python.exe without a script and with a private python311.dll;
9. a new scheduled task;
10. GitHub API or new C2 access.

Each event may have a benign explanation. The sequence is much stronger evidence.

Incident response

When the chain is detected:

• isolate the endpoint;
• preserve memory, Prefetch, Amcache, tasks and PowerShell logs;
• export Defender configuration-change history;
• collect the original LNK, scripts, ZIP and libraries;
• identify credentials used on the workstation;
• hunt across the environment for paths, hashes and behaviours;
• review GitHub API and DNS activity;
• remove unauthorised exclusions after evidence collection;
• rebuild from a trusted image when the backdoor is confirmed;
• monitor affected accounts and the legal-services segment after recovery.

Our Sigma and SIEM detection-engineering guide and incident-response plan provide a repeatable methodology.

Sources versus Breachroad conclusions

Blackpoint confirms two endpoints at one unnamed law firm, the described chain and malware capabilities. Public evidence does not establish attribution, wider scale or complete business impact.

Breachroad’s conclusion is that allowlisting based only on process name or EXE signature cannot stop side-loading. Effective control combines file origin, process ancestry, protection changes, adjacent library provenance and subsequent communication.

Organisational cybersecurity training helps legal teams recognise contextual lures. An IT security audit can review PowerShell, Defender policy, allowlisting and EDR readiness.