Cybersecurity researchers at Blackpoint Cyber have uncovered a previously undocumented malware campaign involving a Go based loader framework named HollowFrame and a Rust based backdoor called Matryoshka. According to the researchers, the malware was deployed during a spear phishing campaign that targeted two endpoints at an unspecified law firm. The attack began with a phishing email containing a link to an encrypted archive that included a Windows Shortcut file disguised as “Case Documents.” Once opened, the shortcut initiated a multi stage infection chain that elevated privileges, weakened Microsoft Defender protections, and downloaded additional malicious components. The researchers stated that the malware framework provided attackers with long term access to compromised systems and enabled a range of post compromise activities that could support broader attacks within an organization’s network.
Blackpoint Cyber explained that HollowFrame is launched through a DLL side loading technique using a legitimate Python executable named python.exe together with a malicious DLL named python311.dll. Acting as a modular loader and persistence framework, HollowFrame is designed to load additional malware while avoiding detection through several anti analysis techniques. Before executing its payload, the loader checks system uptime, available memory, file counts within the user profile, and cursor movement to determine whether it is running in a sandbox or analysis environment. If the environment appears legitimate, HollowFrame establishes persistence by creating a scheduled task before unpacking an encrypted container that launches a second DLL side loading sequence. This process ultimately deploys the Matryoshka backdoor through a malicious version.dll component. Researchers found that the Rust based malware communicates with its command and control server over HTTP, enabling attackers to execute remote commands, deploy additional tools, transfer files, and maintain ongoing access to infected systems.
Researchers identified two separate variants of the Matryoshka malware. One version relies on traditional HTTP communication for command execution and payload delivery, while the second uses a private GitHub repository as its command and control infrastructure. This GitHub based variant, recovered through another malicious DLL named wtsapi32.dll, used the private repository adioziaete/memio to receive commands, upload results, and deliver additional payloads. According to Blackpoint Cyber, each compromised computer was assigned its own directory named after the computer and username, containing files such as beacon.json, cmd.json, and result.json, while some systems also included an upload directory for transferring files. This structure effectively created dedicated mailboxes for every infected endpoint, allowing operators to manage each victim individually without relying on conventional command servers. Researchers noted that using GitHub also provided attackers with version controlled tasking unless the repository or associated commits were later removed. Analysis of the GitHub account revealed that it was created on January 6, 2023, with profile information updated as recently as June 7, 2026, although the identity of the threat actor remains unknown.
According to Blackpoint Cyber researchers Nevan Beal and Sam Decker, the combined capabilities of HollowFrame and Matryoshka provide attackers with persistent remote command execution, Active Directory reconnaissance, file transfer functionality, and the ability to deploy additional malware after the initial compromise. These features could facilitate credential theft, lateral movement across enterprise networks, and broader domain compromise through secondary tools delivered during later stages of the intrusion. The researchers emphasized that each stage of the malware chain intentionally concealed the behavior of subsequent components, ensuring that no individual file contained the complete infection process or the entire command and control logic. This layered design significantly complicates malware analysis, attribution, and detection, while demonstrating how modern threat actors continue adopting modular malware frameworks that separate infection, persistence, and command functionality to reduce visibility during security investigations.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
