HollowFrame + Matryoshka: The New Go/Rust Combo Hitting Law Firms
Just caught the Blackpoint Cyber report on HollowFrame and Matryoshka. It looks like threat actors are leveling up their toolchain, specifically targeting law firms with a sophisticated multi-stage payload.
The intrusion chain is deceptively simple but effective:
- Spear-phishing with a link to an encrypted archive (likely to bypass email scanners).
- LNK file execution inside the archive.
- HollowFrame Loader (Go-based) executes, which then deploys the Matryoshka backdoor (Rust-based).
The shift to Rust for the final payload is concerning—it makes static analysis significantly harder and often bypasses older signature-based engines. Since there are no CVEs attached to this specific malware (it's a toolset, not a vuln), we need to rely heavily on behavioral detection.
I recommend hunting for LNK files spawned from archive extraction processes. If you're using Microsoft Defender, you might want to step up ASR rules regarding Office apps and child processes, though this vector uses standard LNK execution.
Here is a basic PowerShell script to scan user download directories for LNK files created in the last 24 hours, which might help identify the initial access vector:
$Date = (Get-Date).AddDays(-1)
Get-ChildItem -Path "C:\Users\*\Downloads" -Recurse -Filter *.lnk -ErrorAction SilentlyContinue |
Where-Object { $_.LastWriteTime -gt $Date } |
Select-Object FullName, LastWriteTime, @{Name='Owner';Expression={(Get-Acl $_.FullName).Owner}}
Given the reliance on encrypted archives to bypass filtering, are you guys blocking .zip/.rar files with passwords at the gateway, or just relying on endpoint isolation?
Blocking encrypted archives is a non-starter for our legal clients—they live and breathe by them. We focus on the extraction behavior. We've deployed a Sysmon configuration that alerts on any LNK file creation followed immediately by a PowerShell or CMD spawn. It catches a lot of false positives from IT admins, but it's better than the alternative. The Rust angle is worrying though; our sandboxing solution struggles to unpack the symbols.
Good catch on the Go/Rust combo. We analyzed a similar sample last month, and the HollowFrame loader tries to check for debugging environments before unpacking. If you're doing malware analysis, be careful—it detects VMs based on MAC address prefixes. We had to use a hardware-flavored hypervisor to get it to detonate properly.
I’d suggest looking for the HollowFrame C2 traffic. According to the report, it uses specific HTTP headers. You can add this to your SIEM:
DeviceNetworkEvents
| where RemotePort == 443
| where AdditionalFields has "User-Agent: HollowFrame"
Even if they change the UA, the timing of the beaconing (usually every 60s) is a strong indicator once the LNK has been clicked.
Since Tom got cut off, I'll pivot to endpoint telemetry. The Go implementation often leaves distinct build artifacts. Here's a YARA rule we use to catch the HollowFrame loader’s specific section entropy:
rule HollowFrame_Go_Loader {
strings:
$go_string = "Go buildinf:" wide
$s1 = { 4C 6F 61 64 4C 69 62 72 61 72 79 } // LoadLibrary
condition:
uint16(0) == 0x5A4D and $go_string and $s1
}
This helps identify the loader before it unpacks Matryoshka. Has anyone seen variants using different packing methods to evade entropy checks?
To catch Matryoshka's process injection without dedicated EDR, scan for modules loaded from suspicious user directories into system processes. Attackers often drop payloads in AppData or Temp before injecting. This PowerShell command hunts for that behavior:
Get-Process | Select-Object -ExpandProperty Modules | Where-Object { $_.FileName -match '(AppData|Temp)' } | Select-Object ProcessName, FileName
It’s a quick triage method to find unsigned binaries masquerading as legitimate libraries.
Since blocking encrypted archives isn't viable, we focus on rapid triage if a user clicks. We use this PowerShell snippet to hunt for recently created LNK files in user directories, which helps us confirm if the payload stage executed before the loader kicks off.
Get-ChildItem -Path C:\Users -Filter *.lnk -Recurse -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -gt (Get-Date).AddHours(-24) } | Select-Object FullName, LastWriteTime
It's a blunt instrument, but effective for scope assessment during those critical first hours.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access