HollowFrame Loader Deploys Matryoshka Backdoor in Spear-Phishing Attack on Law Firm

Cybersecurity researchers have shed light on a previously undocumented Go-based loader framework called HollowFrame and a Rust-based malware family tracked as Matryoshka. According to Blackpoint Cyber, the intrusion sequence begins with a spear-phishing message containing a link to an encrypted archive, which holds a Windows Shortcut (LNK). Executing the file triggers a multi-stage chain that

The article describes a targeted spear-phishing attack on a law firm using a new Go-based loader HollowFrame and a Rust-based backdoor Matryoshka, delivered via a fake “Case Documents” LNK file in an encrypted archive and involving privilege escalation, Microsoft Defender weakening, and multi-stage payload delivery.[1][2][3] Matryoshka supports HTTP C2 and a GitHub-based variant for command execution, reconnaissance, file transfer, and follow-on tooling, enabling persistence, lateral movement, and broader domain compromise.[1][2] From a RealGround perspective, this style of backdoor-rich intrusion chain is directly relevant to AI environments that rely on developer tools, GitHub, and PowerShell automation, as similar tradecraft could be repurposed to plant malicious code into AI agents, pipelines, or model-serving infrastructure. Organizations should apply Continuous AI Red Teaming to simulate phishing-initiated loader/backdoor chains against AI-related endpoints and use Secure AI Agent Build to harden agent runtimes, enforce strict code-signing and dependency controls, and monitor for anomalous PowerShell, DLL side-loading, and GitHub C2 patterns in environments where AI s