Researchers have uncovered a previously undocumented intrusion framework, HollowFrame, paired with a Rust-based backdoor family tracked as Matryoshka. Together, HollowFrame Matryoshka form a tool chain designed to enter networks through spear-phishing and then expand control in a way that reduces what defenders can see at any single step.
In reporting attributed to Blackpoint Cyber, the activity focuses on a law-firm style target and follows a multi-stage sequence: a carefully crafted message leads recipients to a file that appears benign, which then triggers an execution chain involving side-loading, defensive weakening, and staged payload delivery.
How the spear-phishing lure works
The intrusion begins with a targeted email containing a link to an encrypted archive. Hidden inside that archive is a Windows Shortcut (LNK) file. The LNK is crafted to masquerade as something ordinary—reported as “Case Documents”—to encourage the user to open it.
Once the shortcut is executed, it kicks off a chain of actions rather than launching a single payload directly. According to the researchers, the flow includes privilege escalation, attempts to weaken Microsoft Defender protections, and downloading additional components from a remote server.
The next-stage retrieval is described as occurring from a specific IP address (“2.26.252[.]84”). The exact goal of each step isn’t presented as a single monolithic routine; instead, the design emphasizes splitting behavior across multiple stages.
What HollowFrame does as a modular loader
HollowFrame is described as a Go-based loader framework that supports modular loading and persistence. Rather than acting as a single fixed dropper, it can fetch or initialize auxiliary components using different methods, while also attempting to avoid analysis environments.
A key feature highlighted in the investigation is anti-analysis behavior. The loader checks indicators such as:
- system uptime
- installed memory
- file count in the user profile
- cursor movement
By evaluating these signals, HollowFrame aims to determine whether it is likely running in a sandboxed or non-interactive environment and may avoid proceeding if the environment looks suspicious.
For persistence, HollowFrame sets up a scheduled task, helping maintain an execution foothold even after the initial chain completes.
DLL side-loading chain with python.exe and rogue DLL
The framework’s delivery involves a DLL side-loading pair that includes a legitimate binary, reported as “python.exe”, alongside a malicious companion library, reported as “python311.dll”. In this pattern, the legitimate process is used as a vessel to load an attacker-controlled DLL, thereby hiding malicious logic behind an expected executable.
The Go loader itself is described as containing an encrypted container. It unpacks that container and then starts another side-loading chain to deploy Matryoshka, referenced in the report as a component like “version.dll”.
Matryoshka: two variants for command-and-control
Matryoshka appears in two variants depending on how command-and-control (C2) is carried out. One variant communicates using HTTP-based interactions and can receive commands for execution. The other variant uses GitHub as the C2 mechanism.
This split matters because it changes what defenders can observe. HTTP-based C2 is typically more straightforward to monitor, while GitHub-based polling can blend into normal developer activity patterns—depending on how outbound traffic is monitored.
HTTP variant: shell spawning and follow-on tooling
In the HTTP-based variant, the Rust malware communicates with a reported server (“45.158.196[.]184:8888”) over HTTP. The report describes capabilities such as spawning a shell and delivering additional tooling.
The investigators emphasize that the Rust backdoor isn’t only for simple remote control. It also supports actions that are common stepping stones in deeper intrusion campaigns, such as reconnaissance and staged file transfer.
GitHub variant: tasking via a private repository
The second Matryoshka variant is described as being linked to another DLL recovered during the same activity, reported as “wtsapi32.dll”. This variant uses a private GitHub repository (named in the report as adioziaete/memio) to poll victim-specific commands, submit results, and retrieve payloads.
Rather than maintaining a dedicated command server, the operator appears to treat GitHub as a set of mailbox-like queues per compromised host. The researchers explain that each victim was assigned a dedicated directory in the repository, using a naming pattern like <computer>_<username>.
Within those directories, the repository contained files such as:
- beacon.json
- cmd.json
- result.json
- and sometimes an upload/ tree for file delivery
This structure allowed the operator to manage tasking and results per endpoint using GitHub’s API. The report also notes that using a versioned repository can create a history of changes unless commits or the repository itself are removed.
The investigators also report that querying the GitHub API shows the account was created on January 6, 2023, and profile information was updated as recently as June 7, 2026. At the time of publication, the report states that who was behind the activity was unknown.
Why the chain is built to hide from defenders
One of the most important takeaways from the analysis is the way HollowFrame Matryoshka distributes malicious functionality across stages. The report describes a deliberate design choice: each stage reduces how much malicious behavior is visible in the previous stage.
As a result, analysts may struggle to piece together a complete picture from a single component. If one stage contains limited logic and another stage contains a different slice of C2 or execution functionality, neither part alone provides the full context needed for precise detection and attribution.
The researchers attribute this separation as a factor that complicates both attribution and detection, because no single component holds the entire infection logic or the full C2 view.
Targeted activity and operational impact
Blackpoint Cyber’s findings describe the campaign as targeting two endpoints at an unspecified law firm. The report provides no name for the organization, but it does frame the lure and behavior in a way consistent with law-firm oriented social engineering—such as the “Case Documents” disguise and the use of encrypted archives delivered by link.
Operationally, the combination of HollowFrame and Matryoshka is described as providing the actor with a persistent foothold for remote command execution, along with support for Active Directory reconnaissance, file transfer, and the deployment of additional follow-on tooling.
The researchers also warn that these capabilities can be used to facilitate later outcomes such as:
- credential theft
- lateral movement
- broader domain compromise through extra tools delivered after initial access
Key details to watch in similar intrusions
While every incident will differ, this reporting suggests several concrete indicators and behaviors defenders can map to their monitoring.
- Presence of LNK files delivered via links to encrypted archives, especially when they masquerade as document bundles.
- Unexpected DLL side-loading involving legitimate binaries such as python.exe.
- Persistence via scheduled tasks following unusual execution chains.
- Execution patterns consistent with anti-analysis checks (timing, environment checks, interactive signals).
- Outbound communication to HTTP endpoints or unexpected GitHub private repositories used for tasking.
Monitoring for combinations of these signals can improve detection effectiveness, especially in environments where attackers rely on staged behavior.
Conclusion
The investigation into HollowFrame Matryoshka shows how modern intrusion toolchains can be engineered to be modular, persistent, and harder to analyze as a whole. Starting from spear-phishing with an LNK-based lure, the chain uses DLL side-loading, anti-analysis logic, and staged payload delivery to establish control and then expand capabilities.
Just as importantly, the campaign design breaks up malicious logic across stages so that individual components reveal only part of the story. For organizations, the practical lesson is to look beyond single artifacts and instead correlate execution behavior, persistence changes, and C2 communication patterns across the full chain.
Source: https://thehackernews.com/2026/07/hollowframe-loader-deploys-matryoshka.html
