"Together, HollowFrame and Matryoshka gave the actor a persistent foothold for remote command execution, Active Directory reconnaissance, file transfer, and deployment of follow-on tooling," Nevan Beal and Sam Decker of Blackpoint Cyber wrote.
Spear-phishing chain and initial execution
Blackpoint Cyber says the intrusion that led to the discovery of HollowFrame and Matryoshka began with a targeted spear-phishing message sent to an unspecified law firm. The message contained a link to an encrypted archive that held a Windows Shortcut (LNK) file labeled "Case Documents." When the recipient executed the LNK, a multi-stage chain was launched: PowerShell was used to fetch next-stage components from a remote server identified as 2.26.252[.]84, and the sequence included privilege escalation and measures to weaken Microsoft Defender protections before additional payloads were downloaded. The company reports two endpoints at the firm were targeted in this activity.
HollowFrame loader: Go-based modular framework and persistence
HollowFrame is described by Blackpoint as a previously undocumented loader and persistence framework written in Go. The framework is modular and supports a number of methods for loading auxiliary components. Its runtime includes anti-analysis checks — evaluating system uptime, installed memory, file count in the user profile, and cursor movement — to avoid execution in sandboxed environments. Persistence is achieved by creating a scheduled task.
HollowFrame is launched via a DLL side-loading chain that pairs a legitimate Python binary ("python.exe") with a rogue DLL ("python311.dll"). The Go loader houses an encrypted container which, when unpacked, launches a second side-loading chain that drops Matryoshka under the filename "version.dll."
Matryoshka backdoor: HTTP C2 and a GitHub-powered variant
The Rust-based backdoor family tracked as Matryoshka appears in two variants. One variant communicates over HTTP to a command-and-control server identified as 45.158.196[.]184:8888; Blackpoint says that variant can spawn a shell and deliver additional tooling. A second Matryoshka variant — recovered as "wtsapi32.dll" — uses a private GitHub repository (adioziaete/memio) for command-and-control, polling victim-specific directories to retrieve tasking and submit results.
Blackpoint explains the GitHub repository functioned as a set of per-host mailboxes: each victim was assigned a dedicated <computer>_<username> directory containing beacon.json, cmd.json, result.json and, in some cases, an upload/ tree for file delivery. That structure allowed the operator to manage tasking and results for individual endpoints through GitHub instead of maintaining a custom command server, while leaving a versioned history of repository changes unless commits or the repository were removed.
Querying the GitHub API showed the associated account was created on January 6, 2023, and its profile information was updated as recently as June 7, 2026. Blackpoint notes it is currently not known who is behind the activity.
Operational tradecraft and detection challenges
Blackpoint emphasizes the chain was designed to hide malicious behavior across stages: "Across the chain, each stage reduced the amount of malicious behavior visible in the stage before it," the company said. Splitting functionality among a Go-based loader (HollowFrame), side-loaded DLLs, and a Rust backdoor (Matryoshka) diluted the visibility of any single component and complicated attribution and detection. The use of anti-analysis checks, scheduled-task persistence, DLL side-loading via legitimate binaries, and alternate C2 channels — including a conventional HTTP server and a GitHub repository used as a per-host mailbox — are all singled out in the analysis.
What this means for law firms, security teams, and GitHub repository monitors
- Law firms: Two endpoints at an unnamed law firm were targeted and the initial lure impersonated "Case Documents." Firms handling sensitive client material should note the specific use of document lures and the potential for follow-on tooling that supports credential theft and lateral movement, as described by Blackpoint.
- Security teams and technologists: The activity chain includes telltale artifacts — side-loading of "python311.dll" alongside "python.exe," dropped components named "version.dll" and "wtsapi32.dll," scheduled-task persistence, PowerShell fetches from 2.26.252[.]84, and HTTP connections to 45.158.196[.]184:8888. Detection and response teams can prioritize monitoring for those indicators and for unusual GitHub polling patterns matching the described per-host mailbox structure.
- GitHub and repository monitors: Blackpoint's finding that a private repository (adioziaete/memio) was used as a set of per-host mailboxes highlights how public code-hosting platforms can be repurposed for tasking and file delivery. The account tied to that repository shows a creation date of January 6, 2023, with profile updates as recently as June 7, 2026.
Blackpoint's assessment leaves two concrete takeaways: the chain provided the intruder with a persistent foothold and a flexible means to deliver additional tooling that could enable credential theft, lateral movement, and broader domain compromise; and the operator deliberately separated malicious capabilities across multiple stages to reduce detection and complicate attribution. Who operated the infrastructure and repositories examined remains unknown. For defenders, the record is specific about filenames, IPs, and repository names — and those specifics are the clearest path to detection in this campaign.
