"Effectively prepared a trusted looking execution lane."
The initial intrusion and Defender exclusions
On July 30, Blackpoint Cyber’s Adversary Pursuit Group (APG) published research describing an intrusion that began with a spear-phishing link and landed on two endpoints at a law firm. Recipients who followed the link were redirected to an encrypted archive on Mega containing a shortcut file named Case Documents.lnk. Executing that shortcut wrote Base64 content to a temporary file, rebuilt a script via the built-in certutil utility, and launched an obfuscated PowerShell chain that prompted for administrator rights.
Only after gaining elevation did the attacker create Microsoft Defender exclusions covering a staging directory and the process name python.exe, and then begin downloading executable content. Blackpoint summarized that sequence by noting the actor had "effectively prepared a trusted looking execution lane" before the loader arrived — a deliberate staging step that altered Defender’s view of the forthcoming activity prior to payload delivery.
Fake Python runtime and DLL sideloading
The archive retrieved from Mega was named to resemble an official embedded Python distribution, but the filename read amd96 instead of amd64. Launching the bundled python.exe with no script or module argument moved the chain into DLL sideloading. Crucially, the accompanying python311.dll was not CPython: it was a 64-bit Go library that exported only four Python-compatible function names, enough to satisfy the host process's import requirement and hand execution to malicious Go code.
Built by Nubivance.
OSINTSights' secure edge-first architecture, AI content pipeline, and serverless ops are designed by Nubivance. We do this for clients too.
Talk to us →HollowFrame loader: modular execution, telemetry evasion, persistence
Blackpoint tracked the Go-based loader as HollowFrame. The framework is modular and offers multiple execution methods — including process ghosting, module stomping and manual PE mapping — so the same loader can produce different telemetry on different endpoints. HollowFrame also implemented environmental checks before running, inspecting system uptime, installed memory and cursor movement, and it provided three persistence mechanisms: a scheduled task, a WMI event subscription tied to new logon sessions, and a Startup folder entry.
Matryoshka backdoors and GitHub as a dead drop
HollowFrame dropped a native loader that sideloaded a malicious version.dll beside a legitimate OneDrive updater, placing the first Matryoshka backdoor’s command execution and network traffic inside a trusted Microsoft process. A second Matryoshka variant — a Rust wtsapi32.dll proxying 41 Windows Terminal Services exports — used GitHub for actor tasking. Each victim received a directory in a private GitHub repository that held beacon, command and result files, enabling tasking and file transfer without a custom command-and-control server.
Beyond shell access, the Matryoshka variant could identify domain controllers, enumerate domain computers and privileged group membership, and inventory network configuration, local privileges and installed software. Its requests carried a OneDrive user agent — a behavior Blackpoint included as a detection indicator.
Blackpoint’s recommendations reflect these tactics: correlate unexpected GitHub API connections from non-browser processes with requests for tasking files; flag signed binaries that load adjacent DLLs from user-writable paths; constrain GitHub API access from endpoints with no development role; review scheduled tasks and WMI subscriptions for update-themed names; and detonate password-protected archives and shortcut files in a controlled environment.
What this means for law firms, security teams, and GitHub governance
- Law firms: the intrusion pattern shows how a legal-services environment was targeted via a plausible Case Documents.lnk delivered through Mega, then escalated to persistent, in-network reconnaissance and command execution anchored inside trusted processes.
- Security teams: defenders need to look for post-elevation creation of Defender exclusions (including exclusions targeting python.exe), binaries named like official distributions but with irregular filenames (amd96), and non-browser GitHub API traffic requesting small tasking files — especially when paired with OneDrive user-agent strings.
- Enterprise GitHub governance and IT procurement: Blackpoint’s findings underline a gap where private repositories can be repurposed as dead drops; organizations should constrain API access on endpoints that have no development role and review repository access patterns for unexpected per-victim directories and file exchanges.
The attack chain described by Blackpoint is notable for two linked tactics: pre-emptively altering endpoint defenses to establish a "trusted looking execution lane," and then substituting a counterfeit runtime DLL to hand execution to a modular loader. Those steps — Defender exclusions followed by a fake python311.dll backed by GitHub-based tasking — allowed the actor to blend with expected process names and common cloud services while maintaining flexible persistence and reconnaissance capabilities. Defenders now have a concrete set of indicators and mitigations to hunt for; whether those controls are widely adopted will determine how effective this pattern remains in future intrusions.
Original report — Infosecurity Magazine (link to Blackpoint research)
