Cybersecurity researchers at **Blackpoint Cyber** have shed light on a previously undocumented Go-based loader framework called **HollowFrame** and a Rust-based malware family tracked as **Matryoshka**.  ### The Intrusion Chain: Spear-Phishing to Persistent Foothold According to Blackpoint Cyber, the intrusion sequence begins with a spear-phishing message containing a link to an encrypted archive. This archive holds a Windows Shortcut (**LNK**) file. Executing the LNK file triggers a multi-stage chain that involves privilege escalation, weakening **Microsoft Defender** protections, and downloading additional payloads. ### HollowFrame and Matryoshka: A Dual Threat **HollowFrame** is launched via a DLL side-loading pair, comprising the legitimate **Python** binary ("python.exe") and a rogue DLL ("python311.dll"). **Matryoshka**, on the other hand, comes in two variants: one supporting HTTP-based communication and command execution, and another that ingeniously uses **GitHub** for command-and-control (C2), including beaconing, tasking, reconnaissance, file transfer, and secondary payload delivery. "Together, HollowFrame and Matryoshka gave the actor a persistent foothold for remote command execution, **Active Directory** reconnaissance, file transfer, and deployment of follow-on tooling," security researchers Nevan Beal and Sam Decker noted. "These capabilities could support credential theft, lateral movement, and broader domain compromise through additional tools delivered after initial access." ### Targeting Law Firms with Deceptive Tactics The cybersecurity company stated that the multi-stage intrusion targeted two endpoints at an unspecified law firm. The LNK file was cleverly masqueraded as "Case Documents" to trick the recipient into clicking it. This action activated a command sequence that employs **PowerShell** to fetch next-stage components from a remote server ("2.26.252[.]84"). ### HollowFrame's Evasive Maneuvers **HollowFrame** operates as a modular loader and persistence framework, supporting various methods to load auxiliary components. Crucially, it performs anti-analysis checks to avoid running within sandboxed environments. This evasion is determined based on factors like system uptime, installed memory, file count in the user profile, and cursor movement. Persistence is achieved by setting up a scheduled task.  ### Matryoshka's C2 Innovations The Go loader comes embedded with an encrypted container, which is then unpacked to launch a second side-loading chain to deploy **Matryoshka** ("version.dll"). This Rust-based backdoor communicates with its C2 server ("45.158.196[.]184:8888") over HTTP to spawn a shell and deliver additional tooling. A second DLL ("wtsapi32.dll") recovered in connection with the same activity has been flagged as a variant of **Matryoshka** that leverages a private **GitHub** repository ("adioziaete/memio") for its C2 operations. This repository is used to poll victim-specific commands, submit results, and fetch payloads. "The repository functioned as a collection of per-host mailboxes, with each victim assigned a dedicated <computer>_<username> directory," Blackpoint explained. "These directories contained beacon.json, cmd.json, result.json, and, in some cases, an upload/ tree for file delivery." This innovative C2 mechanism allows the operator to manage tasking and results for individual endpoints through **GitHub** without maintaining a custom command server. It also leaves a versioned history of repository changes unless associated commits or the repository itself are removed. Querying the **GitHub API** for the username "adioziaete" shows the account was created on January 6, 2023, with profile information updated as recently as June 7, 2026. The identity of the threat actor behind this activity remains unknown. ### The Challenge of Attribution and Detection "Across the chain, each stage reduced the amount of malicious behavior visible in the stage before it," Blackpoint noted. "That separation complicated attribution and detection because no single component contained the full infection logic or complete C2 picture." This layered approach underscores the increasing sophistication of threat actors and the ongoing challenges faced by IT security professionals in identifying and mitigating such advanced persistent threats.