HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm

A sophisticated threat actor leveraged a targeted spear-phishing email to deliver the HollowFrame loader, which ultimately installed the Matryoshka backdoor through a multi-stage attack chain initiated by a malicious LNK file inside an encrypted archive. The use of encryption allowed the malicious payload to bypass perimeter email and file scanning controls. Once executed, the malware escalated privileges and actively disabled Microsoft Defender, demonstrating the attacker's focus on persistence and defense evasion. Law firms are high-value targets due to their sensitive client data and privileged communications, making them attractive for espionage or extortion. This attack highlights the danger of trusting archive attachments and the critical need for layered defenses that go beyond endpoint antivirus.