[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fnmUmrIFLrrlVs6nUccHjAMMu72zr6I7_IGpt-N-x4CA":3},{"article":4,"iocs":49,"watch_terms":63,"solutions":64,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"80d0f859-99f5-4213-8ac5-3b0ce62223bf","HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm","hollowframe-loader-deploys-matryoshka-backdoor-in-spear-phishing-attack-on-law-f-b854b6","Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka. According to Blackpoint Cyber, the intrusion sequence begins with a spear-phishing message containing a link to an encrypted archive, which holds a Windows Shortcut (LNK). Executing the file triggers a multi-stage chain that","A new Go-based loader framework called HollowFrame has been identified, used in conjunction with a Rust-based backdoor named Matryoshka. The attack chain begins with a spear-phishing email leading to an encrypted archive containing a malicious LNK file. This file initiates a multi-stage process that escalates privileges, disables Microsoft Defender, and deploys the Matryoshka backdoor, which uses either HTTP or GitHub for command and control.","HollowFrame loader and Matryoshka backdoor deployed via spear-phishing attack on law firm.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F07\u002Fhollowframe-loader-deploys-matryoshka.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgjOaqDYzKWLfOEp56DfMjSmDMudw7Y3DBFUY_xOhGNTnzRYlKw9YCNNbjLvepf-vDHB_KVSSA-KZjx2dNXjJR3ZpTpS_IgGSfhLRjyR2P8ocr_uWQ1w5UcYpuXnycnyv2tPtDqXoZMvD9pqgCNCPDrYMwAup0ftaycFLYzxHvdoOWhEA1ZXffc9ahBpkj5\u002Fs1600\u002Flaw-firm.jpg","2026-07-31T16:39:31+00:00","2026-07-31T18:00:28.421515+00:00",8,[17,20,23],{"name":18,"type":19},"Microsoft Defender","product",{"name":21,"type":22},"Active Directory","technology",{"name":24,"type":25},"Blackpoint Cyber","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":26,"icon":28,"name":29,"slug":30},null,"Malware","malware",[32,37,39,44],{"category":33},{"id":34,"icon":28,"name":35,"slug":36},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":38},{"id":26,"icon":28,"name":29,"slug":30},{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":45},{"id":46,"icon":28,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54,57,60],{"type":51,"value":52,"context":53},"ip","2.26.252.84","IP address used to fetch next-stage components.",{"type":51,"value":55,"context":56},"45.158.196.184","IP address used for Matryoshka backdoor C2 communication.",{"type":30,"value":58,"context":59},"HollowFrame","Go-based loader framework.",{"type":30,"value":61,"context":62},"Matryoshka","Rust-based backdoor.",[24,18],{"controls":65,"vendors":153},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":96,"name":97,"problem":98,"products":99},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":125,"name":126,"problem":127,"products":128},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[],{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":172},"spear-phishing-campaign-deploys-multi-stage-backdoor-against-law-firm","Spear-Phishing Campaign Deploys Multi-Stage Backdoor Against Law Firm","A sophisticated threat actor leveraged a targeted spear-phishing email to deliver the HollowFrame loader, which ultimately installed the Matryoshka backdoor through a multi-stage attack chain initiated by a malicious LNK file inside an encrypted archive. The use of encryption allowed the malicious payload to bypass perimeter email and file scanning controls. Once executed, the malware escalated privileges and actively disabled Microsoft Defender, demonstrating the attacker's focus on persistence and defense evasion. Law firms are high-value targets due to their sensitive client data and privileged communications, making them attractive for espionage or extortion. This attack highlights the danger of trusting archive attachments and the critical need for layered defenses that go beyond endpoint antivirus.",[159,160,161,162,163,164,165,166,167,168,169,170,171],"CIS Control 9: Email and Web Browser Protections","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 IR-4: Incident Handling","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-61: Computer Security Incident Handling Guide","MITRE ATT&CK T1566.001: Spearphishing Attachment","MITRE ATT&CK T1548: Abuse Elevation Control Mechanism","MITRE ATT&CK T1562.001: Disable or Modify Tools","GDPR Article 32: Security of Processing (applicable given sensitive legal client data)",{}]