Recent investigations by cybersecurity experts have unveiled a new Go-based loader framework known as HollowFrame, alongside a Rust-based malware family named Matryoshka. These tools have been used in a sophisticated cyber attack targeting a law firm through spear-phishing tactics.
Intrusion Methodology and Initial Attack
Blackpoint Cyber’s report indicates that the attack initiates with a spear-phishing email containing a link to an encrypted archive. This archive includes a Windows Shortcut (LNK) file, which, when executed, initiates a complex sequence of steps. These steps include elevating privileges, disabling Microsoft Defender, and downloading further malicious payloads.
The HollowFrame loader operates through a DLL side-loading technique, involving a legitimate Python executable (‘python.exe’) paired with a malicious DLL (‘python311.dll’). Meanwhile, Matryoshka presents two distinct variants: one utilizing HTTP for command execution and communication, and another leveraging GitHub for command-and-control (C2) operations.
Capabilities and Impact of HollowFrame and Matryoshka
Security analysts Nevan Beal and Sam Decker highlight that the combination of HollowFrame and Matryoshka provides attackers with a sustained remote access capability. This enables remote command execution, reconnaissance of Active Directory environments, and file transfers, facilitating potential credential theft and lateral movement within the victim’s network.
The attack targeted two endpoints at a law firm, with the LNK file disguised as ‘Case Documents’ to deceive recipients. Once activated, a PowerShell script downloads further components from a remote server (‘2.26.252[.]84’). HollowFrame also employs anti-analysis techniques to evade detection, assessing factors like system uptime and cursor movement.
Technical Details and Future Outlook
Embedded within the Go loader is an encrypted container that unpacks to initiate another side-loading chain, deploying the Matryoshka backdoor (‘version.dll’). This backdoor communicates with its C2 server (‘45.158.196[.]184:8888’) over HTTP to deliver additional tools and execute commands.
Another DLL (‘wtsapi32.dll’) identified in the attack functions as a Matryoshka variant using a private GitHub repository (‘adioziaete/memio’) for task management. It stores victim-specific commands and results, allowing attackers to manage individual endpoints without a dedicated command server.
Despite efforts to trace the attackers, their identities remain unknown. The use of separate stages in the attack chain obfuscates malicious activity, complicating detection and attribution. As cybersecurity threats evolve, understanding such sophisticated methods is crucial for enhancing security measures against similar attacks in the future.
