Blackpoint Cyber researchers discovered a new attack chain targeting a law firm involving HollowFrame, a previously undocumented Go-based loader, and Matryoshka, a Rust-based backdoor family.
The attack begins with spear-phishing emails containing links to encrypted archives. These archives hold Windows Shortcut files (LNK) that, when executed, trigger a multi-stage infection sequence. HollowFrame acts as the loader framework, delivering Matryoshka onto victim systems.
Matryoshka operates as a backdoor, granting threat actors remote access and persistence capabilities on compromised machines. The use of Rust for backdoor development reflects an industry trend toward memory-safe languages that complicate reverse engineering and detection efforts.
The targeting of a law firm indicates this campaign focuses on high-value targets with access to sensitive client data and intellectual property. Law firms handle confidential information across multiple industries, making them attractive targets for espionage, data theft, and ransomware deployment.
The multi-stage infection approach reduces detection by filtering traffic through legitimate processes and obfuscating malicious intent. By encrypting the initial payload archive, attackers impede automated analysis and signature-based detection mechanisms.
Organizations should implement email security controls that scrutinize archive downloads and block or sandbox LNK file execution. Endpoint detection and response (EDR) solutions capable of identifying unsigned or suspicious executables improve visibility into loader activities.
User awareness training addressing spear-phishing tactics proves essential. Law firms operate under heightened risk, requiring elevated email authentication standards, restricted archive handling policies, and process monitoring for unexpected shortcut execution.
HollowFrame and Matryoshka represent a new threat family combination, requiring security teams to monitor emerging indicators of compromise and update detection signatures as more details surface. The attack demonstrates how commodity tools combined with new malware families