The Hacker News32%
HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm 3%
By Ravie Lakshmanan18%
7/31/2026, 9:39:00 AM
Keywords: Hollowframe, Matryoshka, Loader, Backdoor, Spear Phishing, Law Firm, Dll Side Loading, Github C2, Endpoint Security, Malware
BS Summary: This article contains 8 faulty reasoning types, including Negativity Bias, Unattributed Quote, and Anchoring Bias, with Framing Effect as the most egregious example at 9.2% saturation with 47 hits. Analysis detected 210 faulty-reasoning hits from 511 analyzed words, generating a BS Score of 10.2% and a BS Rank of 3% (24,801 of 25,431 articles). This article is better (less manipulative) than 97.50% of the article peer group.
Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka.
According to Blackpoint Cyber, the intrusion sequence begins with a spear-phishing message containing a link to an encrypted archive, which holds a Windows Shortcut (LNK).
Executing the file triggers a multi-stage chain that involves privilege escalation, weakening Microsoft Defender protections, and downloading additional payloads.
While HollowFrame is launched via a DLL side-loading pair comprising the legitimate Python binary ("python.exe") and a rogue DLL ("python311.dll"), Matryoshka comes in two variants, one which supports HTTP-based communication and command execution, and another that uses GitHub for command-and-control (C2), including beaconing, tasking, reconnaissance, file transfer, and secondary payload delivery.
"Together, HollowFrame and Matryoshka gave the actor a persistent foothold for remote command execution, Active Directory reconnaissance, file transfer, and deployment of follow-on tooling," security researchers Nevan Beal and Sam Decker said.
"These capabilities could support credential theft, lateral movement, and broader domain compromise through additional tools delivered after initial access."
The cybersecurity company said the multi-stage intrusion targeted two endpoints at an unspecified law firm, with the LNK file masquerading as "Case Documents" to trick the recipient into clicking it and activating a command sequence that employs PowerShell to fetch next-stage components from a remote server ("2.26.252[.]
84").
HollowFrame operates as a modular loader and persistence framework that supports various methods to load auxiliary components, at the same time performing anti-analysis checks to avoid running within sandboxed environments.
This is determined based on system uptime, installed memory, file count in the user profile, and cursor movement.
Persistence is achieved by setting up a scheduled task.
The Go loader comes embedded with an encrypted container, which is then unpacked to launch a second side-loading chain to deploy Matryoshka ("version.dll"), a Rust-based backdoor that communicates with its C2 server ("45.158.196[.]184:8888") over HTTP to spawn a shell and deliver additional tooling.
A second DLL ("wtsapi32.dll") recovered in connection with the same activity has been flagged as a variant of Matryoshka that makes use of a private GitHub repository ("adioziaete/memio") to poll victim-specific commands, submit results, and fetch payloads.
"The repository functioned as a collection of per-host mailboxes, with each victim assigned a dedicated <computer>_<username> directory," Blackpoint explained.
"These directories contained beacon.json, cmd.json, result.json, and, in some cases, an upload/ tree for file delivery."
"This structure allowed the operator to manage tasking and results for individual endpoints through GitHub without maintaining a custom command server, while also leaving a versioned history of repository changes unless the associated commits or repository were removed."
Querying the GitHub API shows that the account was created on January 6, 2023, and that the profile information was updated as recently as June 7, 2026.
It's currently not known who is behind the activity.
"Across the chain, each stage reduced the amount of malicious behavior visible in the stage before it," Blackpoint noted.
"That separation complicated attribution and detection because no single component contained the full infection logic or complete C2 picture."
Analysis
Hover over highlighted words in the article to view the associated bias or fallacy analysis.