HollowFrame and Matryoshka Malware Target Law Firm in Multi-Stage Intrusion
Summary
Blackpoint Cyber describes HollowFrame and Matryoshka malware used in a spear-phishing intrusion targeting two endpoints at an unspecified law firm, detailing DLL side-loading, persistence, reconnaissance, and HTTP- and GitHub-based command-and-control.
Key points
- The intrusion targeted two endpoints at an unspecified law firm; the actor is unknown.
- A spear-phishing link led to an encrypted archive containing an LNK file disguised as “Case Documents.”
- HollowFrame, a Go-based loader, used DLL side-loading, anti-analysis checks, and a scheduled task for persistence.
- Matryoshka is a Rust-based backdoor with HTTP and GitHub C2 variants, supporting command execution, reconnaissance, file transfer, and payload delivery.
- The GitHub variant used a private repository with per-host directories to poll commands, submit results, and fetch payloads.
- Researchers said the chain could support credential theft and lateral movement; the article does not report that these occurred.
Article Details
- Attack Vectors
- Spear-phishing email linked to an encrypted archive containing an LNK disguised as “Case Documents.”
- The LNK triggered a command sequence using PowerShell to retrieve next-stage components from a remote server.
- HollowFrame used a legitimate python.exe and rogue python311.dll pair for DLL side-loading, then unpacked an encrypted container to launch another side-loading chain.
- HollowFrame used anti-analysis checks based on system uptime, installed memory, user-profile file count, and cursor movement, and established persistence with a scheduled task.
- Matryoshka communicated with a C2 server over HTTP to spawn a shell and deliver additional tooling; a second variant used a private GitHub repository to poll commands, submit results, and fetch payloads.
- Defensive Notes
- The article reports that GitHub repository changes may leave versioned history unless the relevant commits or repository are removed, which may provide investigative evidence.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 2[.]26[.]252[.]84 | Remote server from which PowerShell fetched next-stage components in the reported intrusion. |
| IPV4 | 45[.]158[.]196[.]184 | Matryoshka HTTP C2 server; the article gives the endpoint as 45.158.196[.]184:8888. |
MITRE ATT&CK
T1053.005 · Scheduled TaskHollowFrame established persistence by setting up a scheduled task.T1059.001 · PowerShellThe LNK-triggered command sequence used PowerShell to fetch next-stage components.T1071.001 · Web ProtocolsA Matryoshka variant communicated with its C2 server over HTTP.T1102.002 · Bidirectional CommunicationA Matryoshka variant used a private GitHub repository for bidirectional tasking, results, and payload exchange.T1105 · Ingress Tool TransferThe intrusion fetched next-stage components and used Matryoshka to deliver additional tooling and secondary payloads.T1204.002 · Malicious FileThe recipient was prompted to execute an LNK disguised as “Case Documents” to trigger the attack chain.T1497.001 · System ChecksHollowFrame checked system uptime, installed memory, and user-profile file count as anti-analysis checks.T1497.002 · User Activity Based ChecksHollowFrame used cursor movement as an anti-analysis check based on user activity.T1566.002 · Spearphishing LinkThe intrusion began with a spear-phishing email containing a link to an encrypted archive.T1574.002 · DLL Side-LoadingHollowFrame was launched through DLL side-loading with python.exe and python311.dll; a later side-loading chain deployed Matryoshka.
People
Malware
HollowFrameResearchers uncovered HollowFrame, a Go-based loader framework, and Matryoshka, a Rust-based malware family used in a multi-stage intrusion against two endpoints at a law firm.MatryoshkaResearchers uncovered HollowFrame, a Go-based loader framework, and Matryoshka, a Rust-based malware family used in a multi-stage intrusion against two endpoints at a law firm.
Vendors
Products
GitHubThe attack used spear-phishing, DLL side-loading, and GitHub-based command-and-control to enable persistence, reconnaissance, file transfer, and follow-on payload delivery.Microsoft Defender Antimalware PlatformExecuting the file triggers a multi-stage chain that involves privilege escalation, weakening Microsoft Defender protections, and downloading additional payloads.PythonWhile HollowFrame is launched via a DLL side-loading pair comprising the legitimate Python binary (“python.exe”) and a rogue DLL (“python311.dll”), Matryoshka comes in two variants, one which supports HTTP-based