A previously undocumented loader framework has been observed by Blackpoint Cyber's Adversary Pursuit Group (APG) leveraging a counterfeit Python runtime to disguise Go code, after first configuring Microsoft Defender to overlook the directories and processes it intended to exploit. The intrusion, detailed in research published on July 30, affected two endpoints at a law firm, deploying two new malware families: a Go-based loader dubbed HollowFrame and a pair of Rust backdoors named Matryoshka.
The attack chain commenced with a spear phishing email directed at multiple staff members. A link within the email redirected recipients through an attacker-controlled server to an encrypted archive hosted on Mega. This archive contained a shortcut file, "Case Documents.lnk," which, when executed, wrote Base64 encoded content to a temporary file. This content was then used by the built-in certutil utility to reconstruct and launch an obfuscated PowerShell script.
Upon execution, the PowerShell script prompted the user for administrator privileges. Once elevated, it established Microsoft Defender exclusions for both a staging directory and the process name "python.exe." Only after these exclusions were in place did the system begin downloading executable content, effectively creating a "trusted looking execution lane" for the subsequent payloads.
The downloaded archive was designed to mimic an official Python embedded distribution, though its filename, "amd96," deviated from the standard "amd64." Launching the bundled "python.exe" without any script or module argument initiated a DLL sideloading attack. The accompanying "python311.dll" was not the legitimate CPython library; instead, it was a 64-bit Go library. This malicious DLL exported only four Python-compatible function names, sufficient to satisfy the host's import requirements and transfer execution to the malicious Go code.
This Go code constituted HollowFrame, a modular loader offering various execution methods, including process ghosting, module stomping, and manual PE mapping. This modularity allowed the framework to generate different telemetry across different endpoints. Before executing, HollowFrame performed checks for system uptime, installed memory, and cursor movement. It also offered three persistence mechanisms: a scheduled task, a WMI event subscription linked to new logon sessions, and placement in the Startup folder.
HollowFrame then deployed a native loader that sideloaded a malicious "version.dll" alongside a legitimate OneDrive updater. This action embedded the first Matryoshka backdoor's command execution and network traffic within a trusted Microsoft process. A second Matryoshka variant, implemented as a Rust "wtsapi32.dll" proxying 41 Windows Terminal Services exports, utilized GitHub for command and control.
Each victim was assigned a unique directory within a private GitHub repository, which housed beacon, command, and result files. This setup allowed the operator to issue tasks and transfer files without needing a custom command and control server. Beyond providing shell access, this variant could identify domain controllers, enumerate domain computers and privileged group memberships, and inventory network configurations, local privileges, and installed software. Its network requests were observed to carry a OneDrive user agent, which Blackpoint Cyber identified as a potential detection indicator.
Blackpoint Cyber recommends correlating unexpected GitHub API connections from non-browser processes with requests for tasking files and flagging signed binaries that load adjacent DLLs from user-writable paths. The firm also advises restricting GitHub API access from endpoints that do not have a development role, reviewing scheduled tasks and WMI subscriptions for update-themed names, and detonating password-protected archives and shortcut files in a controlled environment.
