HollowFrame and Matryoshka Show How Modern Malware Attacks Hide Malicious Activity Across Multiple Stages

The recently disclosed HollowFrame and Matryoshka malware campaign demonstrates an increasingly important challenge for enterprise cybersecurity: attackers are deliberately separating malicious activity across multiple components so that no individual stage appears to contain the complete attack.

Cybersecurity researchers investigating an attack against a law firm identified a previously undocumented Go-based loader framework called HollowFrame and a Rust-based backdoor named Matryoshka.

The attack reportedly began with a spear-phishing email containing a link to an encrypted archive. Inside the archive was a malicious Windows Shortcut, or LNK file, disguised as “Case Documents.”

This is significant because the initial attack did not depend on exploiting some exotic zero-day vulnerability. It relied primarily on something far more dependable from an attacker’s perspective: convincing a user that a malicious file was actually a legitimate business document.

Once the victim executed the shortcut, however, the attack rapidly became considerably more sophisticated.

A Multi-Stage Infection Chain

The malicious LNK file initiated a sequence involving PowerShell commands that downloaded additional components from attacker-controlled infrastructure.

The subsequent infection chain reportedly included:

• Privilege escalation

• Attempts to weaken Microsoft Defender protections

• Downloading additional malicious payloads

• DLL side-loading

• Sandbox and analysis evasion

• Scheduled-task persistence

• Command-and-control communication

• Active Directory reconnaissance

• Remote command execution

• File transfer capabilities

• Delivery of additional malware

This progression demonstrates why detecting only the initial malicious file is increasingly insufficient.

Every stage of the attack was designed to perform a specific function while revealing as little as possible about the overall compromise.

HollowFrame as a Modular Malware Loader

HollowFrame functions primarily as a modular malware loader and persistence framework.

It reportedly uses DLL side-loading involving a legitimate Python executable together with a malicious DLL.

DLL side-loading is particularly useful to attackers because it allows malicious code to execute through an otherwise legitimate executable.

Security products or administrators observing the process may initially see a trusted application such as python.exe running.

The important security question therefore becomes not simply:

“Is this executable trusted?”

but rather:

“What exactly is this trusted executable loading and why?”

Attackers increasingly abuse legitimate operating-system utilities, signed binaries, scripting engines and commonly installed applications to execute malicious functionality.

This technique is frequently referred to as living-off-the-land or abuse of trusted applications.

The binary itself may be legitimate. The activity occurring around it may not be.

Anti-Analysis Techniques Complicate Detection

HollowFrame also reportedly performs several checks designed to determine whether it is executing inside a sandbox or malware-analysis environment.

These checks include examining characteristics such as:

• System uptime

• Installed memory

• Number of files inside the user's profile

• Cursor movement

These indicators can help malware determine whether the system resembles a genuine employee workstation.

For example, a newly created automated analysis environment may have very little user activity, minimal files and a short system uptime.

If the malware determines that it is running inside such an environment, it can avoid executing its malicious functionality.

This is an important reminder that malware detection cannot rely solely on executing suspicious files inside automated sandboxes.

Attackers increasingly design malware specifically to identify those environments.

Behavioural monitoring on production endpoints and network-level visibility therefore remain critical additional layers of defence.

Persistence Through Scheduled Tasks

HollowFrame reportedly establishes persistence using Windows scheduled tasks.

Scheduled tasks are legitimate administrative mechanisms widely used by Windows applications and administrators.

Unfortunately, this also makes them attractive to attackers.

A malicious scheduled task can allow malware to execute automatically following system restart or user login, enabling an attacker to maintain access even after the original malicious process has terminated.

Organizations should therefore monitor the creation and modification of scheduled tasks, particularly when they reference unusual executables, DLLs, scripts, temporary directories or user-controlled paths.

Matryoshka Provides the Persistent Backdoor

After HollowFrame establishes the required environment, another DLL side-loading sequence is reportedly used to deploy Matryoshka.

Matryoshka is a Rust-based backdoor designed to provide attackers with continued remote access to compromised systems.

Researchers identified at least two variants.

One communicates with traditional attacker-controlled command-and-control infrastructure over HTTP.

The second uses a significantly more interesting approach: GitHub itself as command-and-control infrastructure.

Using GitHub as Command and Control

The GitHub-based Matryoshka variant reportedly used a private GitHub repository to exchange instructions and results between infected systems and the attacker.

Each infected computer was assigned its own directory based on the computer name and username.

Files stored within these directories were reportedly used for tasks such as:

• Beaconing

• Delivering commands

• Returning command results

• Uploading and downloading files

This effectively transformed GitHub into a mailbox system between the attacker and individual compromised endpoints.

The technique demonstrates one of the biggest challenges facing modern network-security systems.

Traffic going to GitHub is not inherently suspicious.

Developers, administrators, automation systems and legitimate enterprise applications may communicate with GitHub constantly.

Blocking GitHub completely would therefore be impractical for many organizations.

Attackers understand this.

Instead of communicating only with suspicious domains or obscure servers, sophisticated malware increasingly abuses legitimate cloud platforms, code repositories, content-delivery networks and trusted internet services for command-and-control communication.

Traditional IP reputation becomes considerably less effective when malicious activity is travelling toward infrastructure belonging to a trusted global service.

Context Becomes Critical

This attack demonstrates why network security increasingly requires contextual analysis.

Seeing an endpoint establish an HTTPS connection to GitHub tells administrators relatively little.

Security systems need to ask deeper questions.

Which user generated the connection?

Which application initiated it?

Is that application normally expected to communicate with GitHub?

What endpoint generated the traffic?

How frequently is it communicating?

How much information is being uploaded?

Does the user's role normally require access to code repositories?

Did the communication begin immediately after execution of an unusual LNK file?

Was PowerShell executed shortly before the connection?

Did the endpoint recently create a new scheduled task?

Security decisions become significantly stronger when these events can be correlated.

An HTTPS connection to GitHub may be normal.

A workstation belonging to a legal department executing PowerShell through an LNK file, creating a scheduled task and subsequently communicating repeatedly with a private GitHub repository represents an entirely different security context.

Encrypted Traffic Creates Another Visibility Challenge

Modern command-and-control traffic commonly uses HTTPS.

Encryption protects legitimate users from interception, but naturally it also protects attackers from inspection.

When malicious command-and-control activity operates inside encrypted traffic directed toward legitimate cloud infrastructure, basic firewall rules based solely on destination IP addresses and ports become increasingly ineffective.

Organizations therefore need security controls capable of combining multiple sources of intelligence, including:

• Application identification

• User identity

• Endpoint information

• DNS activity

• TLS metadata

• Destination reputation

• Behavioural anomalies

• Data-transfer patterns

• Intrusion-prevention intelligence

• Endpoint telemetry

In environments where organizational policy and privacy requirements permit it, selective inspection of encrypted traffic can provide additional visibility into malicious communications.

However, even without decrypting every connection, contextual and behavioural information surrounding the traffic can provide valuable indicators of compromise.

PowerShell Continues to Be an Attractive Attack Tool

The HollowFrame attack chain also reportedly uses PowerShell during the initial infection process.

This is another recurring feature of modern attacks.

PowerShell itself is not malicious.

It is an extremely capable Windows administration framework, which is precisely why attackers like using it.

Organizations should avoid simplistic policies that treat every PowerShell execution as malicious.

Instead, administrators should monitor how PowerShell is being used.

Examples of suspicious behaviour may include PowerShell being launched unexpectedly from:

• LNK files

• Microsoft Office applications

• Script interpreters

• Temporary directories

• Browser download locations

• Unusual parent processes

PowerShell downloading executable content from the internet should also receive considerably greater scrutiny, particularly when followed by persistence mechanisms or execution of newly downloaded binaries.

Law Firms Remain Attractive Targets

The reported victim in this campaign was a law firm.

Legal organizations can hold extremely sensitive information including:

• Client correspondence

• Corporate documents

• Merger and acquisition information

• Litigation material

• Contracts

• Intellectual property

• Financial information

• Personal information

• Privileged legal communications

A successful compromise can therefore provide attackers with information valuable for financial fraud, corporate espionage, extortion or additional targeted attacks.

Spear-phishing is particularly effective against organizations whose employees routinely exchange documents with people outside their own company.

Receiving a document called “Case Documents” may not appear unusual in a legal environment.

Attackers increasingly design phishing campaigns around the normal workflow of the intended victim.

This makes generic employee warnings such as “do not open attachments” increasingly unrealistic.

Employees need to work with attachments and external documents.

Security controls therefore have to assume that some malicious content will eventually be opened.

Build Security Around Compromise, Not Just Prevention

The most important lesson from the HollowFrame and Matryoshka campaign is that organizations should not depend on a single security layer preventing initial infection.

Assume that eventually:

A phishing email will reach an employee.

An employee may click the link.

The malicious file may execute.

The question then becomes whether the remaining layers of security can identify and contain the attack.

Can endpoint security detect unusual PowerShell execution?

Can the system detect DLL side-loading?

Can privilege escalation be identified?

Can unauthorized changes to endpoint protection be prevented?

Can scheduled-task persistence be detected?

Can unusual outbound communication be identified?

Can lateral movement be stopped?

Can communication with sensitive internal infrastructure be restricted?

Can abnormal data transfers be detected?

This defence-in-depth model is considerably more resilient than expecting an email security product or antivirus engine to detect every initial payload.

Segmentation Can Limit the Damage

Researchers noted that the malware capabilities could potentially support Active Directory reconnaissance, credential theft and lateral movement.

Network segmentation therefore becomes particularly important.

An infected user workstation should not automatically provide unrestricted communication with every server, administrative network and sensitive application inside the organization.

Access between network segments should be explicitly controlled.

Organizations should restrict communication based on legitimate operational requirements rather than simply permitting broad internal access because traffic originates from inside the network.

Internal traffic deserves security inspection too.

The assumption that internal traffic is trusted becomes increasingly dangerous once attackers obtain legitimate credentials or compromise an endpoint.

Monitor Behaviour, Not Just Malware Signatures

HollowFrame and Matryoshka were previously undocumented malware families.

That detail matters.

Signature-based detection remains valuable, but security strategies cannot depend entirely on knowing the exact malware family beforehand.

A previously unseen executable can still generate recognizable malicious behaviour.

For example:

A shortcut launches PowerShell.

PowerShell downloads executable content.

The process attempts privilege escalation.

Endpoint security settings are modified.

DLL side-loading occurs.

A new scheduled task appears.

The endpoint starts beaconing externally.

Active Directory reconnaissance begins.

Files are transferred.

Even when the malware hash or family name is completely unknown, the behaviour represents a suspicious sequence.

This is why effective cybersecurity increasingly combines signature-based protection with behavioural analysis, anomaly detection and contextual intelligence.

The Bigger Security Lesson

The architecture of HollowFrame and Matryoshka reflects how malware development is evolving.

Attackers are breaking complex campaigns into smaller specialized components.

One stage downloads.

Another establishes persistence.

Another evades analysis.

Another executes commands.

Another communicates with the attacker.

Another delivers additional tools.

The benefit to the attacker is simple: no individual component necessarily exposes the complete operation.

Defenders therefore need to correlate events across the entire attack lifecycle rather than evaluating each connection, executable or alert independently.

The future of network security will increasingly depend on understanding relationships between users, applications, endpoints, data and network activity.

A connection may appear legitimate.

A process may appear legitimate.

A cloud service may be legitimate.

The behaviour created when all three are combined may be anything but legitimate.

HollowFrame and Matryoshka demonstrate that detecting modern cyberattacks requires moving beyond the question of whether an individual object is malicious and instead understanding whether the overall activity makes sense in the context of the user, device and organization.

That contextual visibility can make the difference between identifying an attack during its initial stages and discovering it only after an attacker has established persistent access across the network.

Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka. According to Blackpoint Cyber, the intrusion sequence begins with a spear-phishing message containing a link to an encrypted archive, which holds a Windows Shortcut (LNK). Executing the file triggers a multi-stage chain that

Source: HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm via The Hacker News — published 31 Jul 2026.