HollowFrame & Matryoshka: Detecting the Go/Rust Threat Chain Targeting Law Firms

The legal sector remains a prime target for cybercriminals due to the sensitivity of client data and the high propensity for rapid ransom payments. In a recent development uncovered by Blackpoint Cyber, threat actors have escalated their tooling, deploying a previously undocumented Go-based loader framework dubbed HollowFrame, which subsequently delivers a Rust-based malware family tracked as Matryoshka.

This intrusion set is not merely a theoretical construct; it is currently active in the wild. The attack leverages a precision "spear-social engineering" vector—specifically, a link to an encrypted archive—trusting the victim to manually bypass email filters by entering a password. Inside sits a Windows Shortcut (LNK) file. Upon execution, this file triggers a sophisticated multi-stage chain leading to the HollowFrame loader and ultimately the Matryoshka payload.

For defenders, this represents a significant shift. The use of Golang and Rust indicates an adversary focused on evasion. These languages complicate static analysis and reverse engineering, often allowing malware to slip past signature-based defenses. Immediate action is required to identify the initial access vectors—the malicious LNK files—and detect the behavioral anomalies of the HollowFrame loader.

Technical Analysis

Threat Overview

• HollowFrame: A Golang-based loader. The use of Go allows the attackers to compile the malware for multiple platforms with relative ease and often results in binaries with stripped symbols, hindering analysis. Its primary role is to establish a foothold and decrypt/load the next stage.
• Matryoshka: A Rust-based malicious software family. Rust is memory-safe and offers high performance, but more importantly for threat actors, it generates binaries with distinct, often non-standard control flows that frustrate automated sandbox analysis.

The Attack Chain

1. Initial Access: The attack begins with a spear-phishing email (social engineering) tailored to the law firm's context.
2. Delivery: The email contains a link to an encrypted archive (e.g., a password-protected ZIP file).
3. User Interaction: The user downloads the archive and extracts the contents using the password provided in the email body (a technique used to bypass secure email gateways).
4. Execution: Inside the archive is a Windows Shortcut (.lnk) file. This is not a standard document shortcut but a malicious wrapper designed to execute a hidden command.
5. Payload Deployment: Executing the LNK triggers the HollowFrame loader.
6. C2 & Objectives: HollowFrame decrypts and loads the Matryoshka malware, which establishes unauthorized access, likely for data exfiltration or ransomware deployment.

Affected Products/Platforms:

• Platform: Microsoft Windows (all currently supported versions vulnerable to LNK-based execution).
• Vector: User-driven execution via Windows Explorer or Shell.

Exploitation Status:

• Status: Confirmed Active Exploitation.
• Context: Identified in a targeted campaign against a law firm. No CVE is required for this attack as it abuses legitimate functionality (LNK files) rather than a software vulnerability.

Detection & Response

Detecting this threat requires a layered approach. Traditional antivirus may struggle with the packed/compiled nature of Go and Rust binaries. Therefore, we focus on the Tactics, Techniques, and Procedures (TTPs): the delivery of LNK files from archives, the execution of unsigned binaries from user directories, and the specific behavioral fingerprints of the HollowFrame loader.

Sigma Rules

The following Sigma rules target the initial LNK execution and the subsequent suspicious process spawning characteristic of the HollowFrame loader.

---
title: Suspicious LNK File Execution from User Directory
id: 8a4c2b91-3d5e-4f9a-9b7c-1e2f3a4b5c6d
status: experimental
description: Detects the execution of Windows Shortcut (LNK) files from common user download or temp directories, a common vector for loaders like HollowFrame.
references:
  - https://thehackernews.com/2026/07/hollowframe-loader-deploys-matryoshka.html
author: Security Arsenal
date: 2026/07/20
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\cmd.exe' # LNKs often spawn cmd
    ParentImage|endswith:
      - '\explorer.exe'
      - '\winword.exe'
      - '\outlook.exe'
    CommandLine|contains: '.lnk'
  filter:
    CommandLine|contains:
      - 'AppData\\Local\\Microsoft\\WindowsApps' # False positive Windows 10/11 apps
falsepositives:
  - Legitimate user shortcuts run from desktop
level: medium
---
title: Potential HollowFrame Go Loader Activity
id: 9b5d3c02-4e6f-5a0b-0c8d-2f3g4h5i6j7k
status: experimental
description: Detects suspicious unsigned binaries (potentially compiled with Go) spawned from a shell or LNK execution, immediately initiating network connections.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/07/20
tags:
  - attack.execution
  - attack.command_and_control
  - attack.t1071
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Image|contains:
      - '\Downloads\'
      - '\AppData\\Local\\Temp\'
    # HollowFrame and similar Go loaders often lack CompanyName and ProductVersion metadata in default compilations
  condition: selection AND NOT filter
  filter:
    Signed: 'true'
falsepositives:
  - Legitimate portable software run from Downloads
level: high

KQL (Microsoft Sentinel / Defender)

This KQL query hunts for the sequence of events where a process creates an LNK file or a user interacts with an LNK, followed by an unsigned process making a network connection—a strong indicator of HollowFrame beaconing.

let TimeFrame = 1h;
// Look for LNK file executions or creations
let LNKEvents = DeviceProcessEvents
| where Timestamp > ago(TimeFrame)
| where FileName =~ "cmd.exe" or FileName =~ "powershell.exe"
| where ProcessCommandLine contains ".lnk" 
   or ProcessCommandLine contains ".zip";
// Correlate with unsigned network connections from the same device
let NetworkConnections = DeviceNetworkEvents
| where Timestamp > ago(TimeFrame)
| where InitiatingProcessVersionInfoCompanyName == ""
| where InitiatingProcessFilePath contains "Downloads" 
     or InitiatingProcessFilePath contains "Temp";
LNKEvents
| join kind=inner NetworkConnections on DeviceId
| project Timestamp, DeviceName, AccountName, 
          ProcessCommandLine, RemoteIP, RemotePort, 
          InitiatingProcessFilePath, InitiatingProcessSHA256

Velociraptor VQL

This Velociraptor artifact hunts for LNK files in user directories and parses their target commands to identify suspicious shell execution chains indicative of the spear-phishing vector.

-- Hunt for recently modified LNK files in user profiles and analyze their targets
SELECT FullPath, Mtime, Size,
       parse_string(data=Data, regex= "(?s)LinkTargetInfo.*?(ShellLinkHeader).*?(RelativePath).*?([\x00-\xff]{1,260})") AS RelativePath
FROM glob(globs="C:\Users\*\*.lnk", root="/")
WHERE Mtime > now() - 7d
  -- Filter for LNKs that might be executing commands or pointing to exes in unusual locations
  AND (RelativePath =~ "cmd" OR RelativePath =~ "powershell" OR RelativePath =~ "tmp" OR RelativePath =~ "downloads")

Remediation Script (PowerShell)

Use this script to scan endpoints for LNK files in user profile directories that were recently created or modified and contain references to command interpreters, a common sign of this attack vector.

<#
.SYNOPSIS
    Detects suspicious LNK files potentially used in HollowFrame delivery.
.DESCRIPTION
    Scans user profiles for LNK files created in the last 30 days that reference cmd.exe or powershell.exe.
#>

$CutoffDate = (Get-Date).AddDays(-30)
$SuspiciousCount = 0

Get-ChildItem -Path "C:\Users" -Recurse -Filter "*.lnk" -ErrorAction SilentlyContinue | ForEach-Object {
    if ($_.LastWriteTime -gt $CutoffDate) {
        $shell = New-Object -ComObject WScript.Shell
        $shortcut = $shell.CreateShortcut($_.FullName)
        $target = $shortcut.TargetPath
        
        if ($target -match "cmd.exe" -or $target -match "powershell.exe") {
            Write-Host "[!] Suspicious LNK Found: $($_.FullName)"
            Write-Host "    Target: $target"
            Write-Host "    Arguments: $($shortcut.Arguments)"
            $SuspiciousCount++
        }
    }
}

if ($SuspiciousCount -eq 0) {
    Write-Host "No suspicious LNK files detected in the scan period."
} else {
    Write-Host "Scan complete. $SuspiciousCount suspicious artifacts found."
}

Remediation

1. User Education & Communication: Immediately notify staff—specifically legal teams handling sensitive case files—about the risks of encrypted archives. Emphasize that password-protected ZIP files received via unexpected email are a primary delivery vector for this threat.

2. Email Gateway Hardening: Configure secure email gateways (SEG) to block or sandbox password-protected archives. If business requirements necessitate their use, implement strict quarantine policies where the archive must be submitted for analysis in a sandbox before delivery to the user.

3. Isolate and Investigate: If the Sigma rules or scripts detect a compromise:

   • Isolate the affected host from the network immediately to prevent Matryoshka C2 communication.
   • Capture a full memory image to identify the hollow process injection techniques often used by Go loaders.
   • Check for persistence mechanisms in Run/RunOnce registry keys or Scheduled Tasks.

4. Block Unsigned Executables: Enforce Application Whitelisting (e.g., AppLocker or Windows Defender Application Control) to prevent the execution of unsigned binaries from user directories (%USERPROFILE%\Downloads, %APPDATA%\Local\Temp). This would effectively neutralize the HollowFrame loader's execution path.

5. Threat Hunt: Use the provided VQL and KQL queries across the enterprise to identify other potential instances of the LNK delivery mechanism that may have bypassed initial detection.

Related Resources

Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub