Full research report

HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm

Original reporting ↗
★ Threat intelligence assessment medium confidence

Executive assessment

HollowFrame and Matryoshka are two previously undocumented malware families disclosed by Blackpoint Cyber on 31 July 2026, deployed together against a law firm in a spear-phishing intrusion that exploited trusted-application DLL search-order abuse rather than software vulnerabilities. The campaign's most notable characteristic is Matryoshka's use of a private GitHub repository as a per-victim command-and-control mailbox, avoiding dedicated infrastructure while inadvertently creating a version-controlled record of operator tasking activity. The staged, layered architecture — in which each component reveals only a fragment of the C2 picture — reflects deliberate operational security tradecraft rather than opportunistic access. Attribution remains entirely unresolved, with the GitHub account 'adioziaete' providing a weak chronological anchor (created January 2023, active through June 2026) but no actor cluster linkage. Confidence is constrained to medium because the primary Blackpoint research blog was inaccessible during this investigation, leaving The Hacker News as the sole verified source domain.

What happened

On 31 July 2026 Blackpoint Cyber published research disclosing two previously undocumented malware families — HollowFrame, a Go-based modular loader, and Matryoshka, a Rust-based backdoor — used together in a targeted intrusion against an unspecified law firm. The attack chain began with a spear-phishing email bearing a link to an encrypted archive containing a Windows Shortcut (LNK) file disguised as 'Case Documents'. Execution of the LNK triggered a PowerShell-driven multi-stage sequence that escalated privileges, weakened Microsoft Defender protections, and deployed both malware families across two endpoints.

Affected scope

Windows endpoints in the legal sector; no specific Windows version was stated. Two endpoints at a single unnamed law firm were confirmed compromised. No sector-wide or mass-exploitation event has been reported.

Technical assessment

HollowFrame abuses DLL search-order to load a malicious 'python311.dll' alongside the legitimate 'python.exe' binary, executing within a trusted process context. The loader embeds an encrypted container, performs sandbox-evasion checks based on system uptime, available memory, user profile file count, and cursor movement, and establishes persistence via a Windows scheduled task. A second side-loading chain then deploys Matryoshka as 'version.dll', which beacons over HTTP to a dedicated C2. A second Matryoshka variant ('wtsapi32.dll') uses a private GitHub repository as a per-victim command mailbox — assigning each compromised host a dedicated directory for tasking, results, and file delivery — avoiding custom C2 infrastructure while leaving a version-tracked operator activity log. Each stage of the chain exposes only a fragment of the overall infection logic, deliberately complicating attribution and detection.

Recommended defensive actions

  1. Block or restrict LNK file execution delivered via email or downloaded from the internet using mail-gateway policy and Attack Surface Reduction rules.
  2. Hunt for python.exe loading unsigned or unexpected DLLs such as python311.dll, version.dll, or wtsapi32.dll using endpoint detection and response (EDR) telemetry.
  3. Block outbound connections to 45.158.196[.]184 on port 8888 and audit GitHub API calls from non-developer endpoints, particularly to the repository path adioziaete/memio.
  4. Audit Windows scheduled tasks for entries with unusual command-line arguments involving Python execution or references to side-loaded DLL pairs.
  5. Enable and enforce Microsoft Defender tamper protection to prevent post-exploitation scripts from weakening antivirus policy.

Uncertainties and evidence gaps

  • Threat actor identity and attribution are entirely unknown; the GitHub account 'adioziaete' was created January 2023 and last updated June 2026, but no actor group, nation-state nexus, or TTP overlap with known clusters has been established.
  • The full breadth of targeting is unknown; only a single law firm with two endpoints is confirmed, and broader targeting of the legal sector remains speculative.
  • Whether additional undisclosed variants of HollowFrame or Matryoshka exist, and the full scope of follow-on tooling deployed after initial access, have not been made public.
  • The original Blackpoint Cyber research blog post was inaccessible during this investigation (HTTP 403); all technical findings are drawn from The Hacker News's published account, representing a single independently verified source domain.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessExternal; attacker delivers a spear-phishing email to a targeted individual at a law firm, requiring the recipient to follow a link and execute a malicious LNK file.
ComponentWindows Shell (LNK execution), Python runtime DLL search order, Microsoft Defender Antivirus, Windows Task Scheduler, Active Directory.
MechanismLNK execution spawns PowerShell to fetch staged components from a remote server; DLL search-order abuse causes a trusted Python binary to load a malicious library; an embedded encrypted container unpacks a second side-loading chain; persistence is set via Task Scheduler.
ImpactPersistent remote command execution, Active Directory enumeration, file exfiltration, and a delivery channel for further payloads enabling potential credential theft, lateral movement, and domain compromise.
DetectionUnexpected DLL loads by python.exe (python311.dll, version.dll, wtsapi32.dll); scheduled task creation with Python-based launch commands; outbound HTTP to 45.158.196[.]184:8888; GitHub API calls to private repository adioziaete/memio from non-developer endpoints.
MitigationBlock LNK execution from untrusted locations; enforce MDE tamper protection; block identified C2 IPs at the perimeter; hunt and remove scheduled tasks and DLL pairs matching the described pattern.
Exploitation status

No confirmed active exploitation and no public proof-of-concept; this campaign represents a targeted intrusion against a single law firm and the first public documentation of both malware families by Blackpoint Cyber in July 2026.

Research process

Investigation began with the THN article as the sole supplied source, reporting on newly disclosed Blackpoint Cyber research by named researchers Nevan Beal and Sam Decker. Attempts to access the original Blackpoint Cyber blog and a corroborating SC Media brief both returned HTTP 403, preventing independent domain-level verification. Searches targeting the GitHub C2 account, named IOCs, and researcher identity confirmed the THN account is grounded in primary Blackpoint research but returned no independently accessible corroborating domain. The assessment is therefore confined to a single verified reporting source, which constrains confidence to medium.

  1. What are the confirmed technical facts about HollowFrame and Matryoshka?
    Fetched the THN article directly to extract structured facts from the primary reporting source.
    thehackernews.com ↗

    Confirmed: Go-based HollowFrame loader using python.exe DLL side-loading; Rust-based Matryoshka with HTTP and GitHub C2 variants; law firm target (two endpoints); C2 addresses 2.26.252[.]84 and 45.158.196[.]184:8888; GitHub repository adioziaete/memio; researchers Nevan Beal and Sam Decker of Blackpoint Cyber.

    why Established a verified baseline of technical facts before seeking corroboration or gaps.

  2. Are there additional independently accessible sources or the original Blackpoint Cyber research post?
    Searched for Blackpoint Cyber blog coverage and other outlets covering HollowFrame and Matryoshka.

    Identified SC Media brief and a Blackpoint blog URL as candidate corroborating sources; KSEC community forum also appeared as a secondary hit.

    why Needed at least one independent domain to corroborate the THN account before drawing conclusions.

  3. Can SC Media's brief be accessed to provide independent corroboration?
    Attempted to fetch the SC Media brief.
    scworld.com ↗

    HTTP 403 Forbidden; content inaccessible.

    why SC Media cannot be cited as a verified independent source; reduces confidence in cross-domain corroboration.

  4. Is the original Blackpoint Cyber research blog directly accessible?
    Attempted to fetch the Blackpoint Cyber blog post identified as the primary research source.
    blackpointcyber.com ↗

    HTTP 403 Forbidden; the entire Blackpoint Cyber blog domain returns 403 to automated fetches.

    why Primary research source cannot be directly verified or cited; all Blackpoint technical detail must be accepted via the THN intermediary.

  5. Does the KSEC community forum post add technical detail beyond the THN article?
    Fetched the KSEC forum thread.
    forum.ksec.co.uk ↗

    Forum post mirrors the THN article without additional technical content, IOCs, or attribution detail.

    why Does not constitute an independent corroborating source; no new information added to the assessment.

  6. Can the GitHub C2 account 'adioziaete' or IOC references support attribution or evidence of broader targeting?
    Searched for the GitHub username, IOC references, and related actor chatter in open sources.

    No independent IOC repositories, threat actor profiles, or attribution records link these IOCs to a known group or prior campaign.

    why Attribution remains entirely unknown; no actor cluster or TTP overlap was identified.

  7. Does prior use of wtsapi32.dll or version.dll side-loading connect this campaign to a known threat actor?
    Searched for the specific DLL names in the context of known threat actor techniques.

    wtsapi32.dll has been abused in prior unrelated campaigns, but no documented link to the Matryoshka campaign or its operator was established.

    why DLL names alone are insufficient for attribution; both are widely documented hijackable libraries used across many unrelated threat clusters.

Named in this story
Actorsunknown
MalwareHollowFrameMatryoshka
Targetsunspecified law firm (legal sector)

Research coverage

All 68 registered source leaves were evaluated for this run: 59 completed, 0 were unavailable, 2 failed and 7 were disabled. For this story, 1 registered sources supplied useful evidence (1 primary, 0 corroborating, 0 contextual and 0 PoC/exploit references). 58 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
The Hacker Newsnews ok8 records Primary evidence1 matched items Published the source report used to frame and date the event.
AlienVault OTXdark_web failed0 records Failed The current collection attempt failed; this source cannot support the report.
BleepingComputernews ok7 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
CISA Alertsnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
CISA KEVkev ok1656 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5309 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok260 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok669 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1006 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch failed0 records Failed The current collection attempt failed; this source cannot support the report.
Exploit-DBexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
FIRST EPSSepss ok Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok13 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok5 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Microsoft MSRCvendor_advisory ok1588 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
MISP Galaxyresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Rapid7news ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Sigma Rulesresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 5 opened outside the registered collection
References & evidence
Analysis & research1
HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm thehackernews.com ↗

Primary verified account of the campaign, summarising Blackpoint Cyber researchers Nevan Beal and Sam Decker's technical findings.