HollowFrame Loader and Matryoshka Backdoor Target Law Firm in Spear-Phishing Attack
A new Go-based loader, HollowFrame, has been identified deploying the Matryoshka backdoor in a sophisticated spear-phishing attack targeting a law firm.
Cybersecurity researchers have uncovered a novel attack chain involving a previously undocumented Go-based loader framework named HollowFrame and a Rust-based malware family dubbed Matryoshka. The intrusion sequence, detailed by Blackpoint Cyber, begins with a targeted spear-phishing email containing a link to an encrypted archive. This archive, upon extraction, reveals a Windows Shortcut (LNK) file designed to trick recipients into initiating a multi-stage infection process.
The initial execution of the LNK file, disguised as "Case Documents," triggers a series of commands, often employing PowerShell, to fetch subsequent stages from a remote server. The HollowFrame loader itself operates as a modular framework, incorporating anti-analysis techniques to evade detection within sandboxed environments. It checks system uptime, installed memory, file count in the user profile, and cursor movement to determine if it's being analyzed. Persistence is established through the creation of a scheduled task.
HollowFrame is launched using a DLL side-loading technique, pairing the legitimate Python binary ("python.exe") with a malicious DLL ("python311.dll"). Once loaded, HollowFrame unpacks an encrypted container, which then initiates another side-loading chain to deploy the Matryoshka backdoor. This backdoor, written in Rust, comes in at least two variants, each with distinct command-and-control (C2) mechanisms.
One variant of Matryoshka communicates with its C2 server over HTTP, enabling remote command execution, Active Directory reconnaissance, file transfer, and the deployment of additional tools. The second variant, identified as "wtsapi32.dll," leverages a private GitHub repository for its C2 operations. This approach allows threat actors to manage tasking and results for individual endpoints through GitHub, utilizing per-host mailboxes within the repository structure.
The GitHub C2 method involves directories named <computer>_<username> containing files like beacon.json, cmd.json, and result.json. This structure provides a versioned history of operations unless commits or the repository are deleted, offering a degree of operational security for the attackers. The GitHub account associated with this activity was created in early 2023 and updated recently, indicating ongoing operations.
The combined capabilities of HollowFrame and Matryoshka provide attackers with a persistent foothold for remote command execution, reconnaissance, and the deployment of further malicious tooling. This could facilitate credential theft, lateral movement across the network, and ultimately lead to a broader domain compromise.
The multi-stage nature of this attack, where each stage obscures the malicious behavior of the preceding one, complicates attribution and detection efforts. No single component reveals the full infection logic or the complete C2 infrastructure, making it challenging for security teams to piece together the entire attack chain. The specific law firm targeted was not disclosed, but the attack involved two endpoints.