Law Firm Hit by Spear-Phishing Attack Using New 'HollowFrame' Loader and Rust-Based 'Matryoshka' Backdoor

Key points

• Researchers at Blackpoint Cyber have documented two previously unseen tools: a loader called HollowFrame and a backdoor called Matryoshka, used against a law firm.
• The attack started with a spear-phishing email, a targeted message crafted for a specific person, containing a link to an encrypted archive.
• Inside the archive was a Windows Shortcut file (an LNK) that kicked off a multi-stage infection chain when opened.
• HollowFrame is written in Go and Matryoshka is written in Rust, two languages increasingly favoured by attackers to slow down analysis.
• Law firms hold sensitive client material, making them a repeat target for espionage-style intrusions.

A law firm has become the test case for two new pieces of attacker software that hadn't been publicly named before this week.

The tools are called HollowFrame, a loader (the small program that pulls in the real malware), and Matryoshka, a backdoor (software that gives an intruder remote control of a computer). Both were spotted by Blackpoint Cyber, whose findings were first written up by The Hacker News. Blackpoint is the same team whose Rust-based LabubaRAT we covered on 14 July shows how often they're the ones finding things no one else has named yet.

This is the kind of quiet, targeted intrusion that never makes the evening news but ends with client files sitting on a server somewhere else.

How did the attackers get in?

Through email. Someone at the firm received a spear-phishing message: a fake email written specifically for them rather than blasted out to thousands of people.

The email carried a link pointing to an encrypted archive, a password-protected compressed file. That's a common trick to slip past email scanners that can't see inside. Inside the archive sat a Windows Shortcut file, the same kind of icon you'd double-click to open a program. Opening it didn't launch anything the victim expected. It quietly ran a chain of commands that pulled in the next stage.

One click, one shortcut, and the rest happens without the user seeing a thing. That failure mode is older than most of the people reading this.

What do HollowFrame and Matryoshka actually do?

HollowFrame is the delivery mechanism. Matryoshka is the payload.

HollowFrame's job is to run on the machine and fetch what comes next. Written in Go, a language built by Google, it produces binaries that are bulky and awkward for older antivirus tools to parse cleanly.

Matryoshka lands after HollowFrame does its work. Written in Rust, it gives the attackers remote control: running commands and moving deeper into the network at their own pace. The name nods to Russian nesting dolls, which fits. The malware unpacks in layers, each revealing the next.

Should ordinary people be worried?

Not directly, but clients of the firm might be. Law firms hold divorce papers, contracts and deal memos. A backdoor on a partner's laptop is a leak waiting to happen.

If you've used a law firm recently and receive an unusual message referring to your case, especially one asking you to click a link, phone the firm on a number you already have. Don't use contact details from the email itself.

What the post-mortem will say

The shortcut file should never have been able to run from an archive downloaded via a link in an email.

Group Policy on Windows can block LNK files from launching scripts. Email gateways can strip or quarantine password-protected archives. Endpoint tools can flag Go and Rust binaries writing to user-profile directories. None of this is exotic. It's just work that tends to sit at the bottom of someone's Jira board.

If your users can double-click their way from an inbox to arbitrary code execution, the language the malware's written in barely matters.