Cybersecurity researchers have uncovered two previously unknown malware tools—a Go-based loader framework dubbed HollowFrame and a Rust-based backdoor family called Matryoshka—deployed together in attacks targeting at least one law firm. The discovery was detailed by Blackpoint Cyber, which analyzed a multi-stage intrusion that began with a spear-phishing email and culminated in persistent remote access to victim networks. The attack chain leveraged encryption, legitimate software disguises, and even GitHub repositories to evade detection and maintain control.
The intrusion began with a phishing message containing a link to an encrypted archive holding a Windows Shortcut file. The LNK file posed as "Case Documents" to lure the recipient into executing it, which triggered a command sequence using PowerShell to retrieve additional components from a remote server at the IP address 2.26.252[.]84. HollowFrame, the first-stage loader, disguised itself through DLL side-loading by pairing a legitimate Python executable (python.exe) with a malicious DLL file (python311.dll). It incorporated anti-analysis techniques that checked system uptime, installed memory, file count in the user profile, and cursor movement to avoid running in sandboxed testing environments. The framework achieved persistence by creating a scheduled task, then unpacked an encrypted container to launch a second side-loading chain that deployed Matryoshka, the Rust-based backdoor. Matryoshka came in two versions: one that communicated over HTTP with a command-and-control server at 45.158.196[.]184:8888, and another that used a private GitHub repository (adioziaete/memio) for beaconing, tasking, reconnaissance, file transfer, and payload delivery.
Security researchers Nevan Beal and Sam Decker wrote that "Together, HollowFrame and Matryoshka gave the actor a persistent foothold for remote command execution, Active Directory reconnaissance, file transfer, and deployment of follow-on tooling." They noted these capabilities could enable credential theft, lateral movement, and broader domain compromise through additional tools delivered after initial access. The GitHub-based variant organized victim data in a unique structure: "The repository functioned as a collection of per-host mailboxes, with each victim assigned a dedicated
The multi-stage design served a clear purpose: obscuring the full scope of the attack. Each stage reduced the amount of malicious behavior visible in the preceding one, according to Blackpoint, complicating both attribution and detection because no single component contained the complete infection logic or full command-and-control picture. The use of legitimate Python binaries for side-loading made initial detection harder, as security tools would see trusted software executing. The GitHub-based command infrastructure offered additional stealth advantages: traffic to GitHub appears normal in most corporate networks, and the platform's infrastructure provides reliability and anonymity that custom servers can't match. The anti-analysis checks built into HollowFrame meant that security researchers analyzing samples in virtual machines might never see the malware activate, allowing it to slip past automated detection systems.
The identity of the threat actor behind this campaign remains unknown. The attack's targeting of a law firm and use of case document lures suggests a focus on organizations handling sensitive legal or financial information. The combination of custom-built frameworks in two different programming languages (Go and Rust) indicates a sophisticated adversary with development resources and operational security awareness. The nearly three-and-a-half-year gap between the GitHub account's creation and its use in this recent campaign points to long-term planning or infrastructure reuse across multiple operations.