New Go-Based HollowFrame Loader Targets Law Firms with Matryoshka Backdoor
A novel spear-phishing campaign uses a Go-based loader and Rust backdoor to infiltrate law firms. The attack chain leverages encrypted archives and LNK files to deploy malware.
TL;DR
- Attackers used a new Go loader called HollowFrame in phishing campaigns.
- The payload is a Rust-based backdoor named Matryoshka.
- Law firms were targeted through malicious LNK files in encrypted archives.
- Multi-stage execution makes detection harder for traditional defenses.
- Organizations should enhance email filtering and monitor for unusual network activity.
Cybersecurity researchers have uncovered a previously unknown malware deployment technique involving a Go-based loader framework called HollowFrame and a Rust-based backdoor known as Matryoshka. This combination has been observed in targeted attacks against law firms through carefully crafted spear-phishing messages.
The initial infection vector involves an email containing a link to an encrypted archive. Once downloaded and opened, the archive reveals a Windows Shortcut (LNK) file. Execution of this file initiates a complex multi-stage process designed to evade detection while establishing persistent access to victim systems.
Attack Chain Breakdown
- Spear-phishing emails contain links to password-protected archives.
- Archives include malicious LNK files that initiate the infection process.
- HollowFrame acts as a first-stage loader written in Go language.
- It downloads and executes the second-stage payload: Matryoshka backdoor.
- Matryoshka is built in Rust, offering cross-platform capabilities.
Defensive Recommendations
- Implement advanced email filtering to detect suspicious attachments and links.
- Monitor endpoint behavior for signs of LNK file abuse or anomalous execution chains.
- Use behavioral analytics to identify post-compromise activities like lateral movement.
- Keep systems updated and apply security patches promptly.
- Train staff on recognizing social engineering tactics used in spear-phishing.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.