Law Firm Hit by Spear-Phishing Attack Using New 'HollowFrame' Loader and Rust-Based 'Matryoshka' Backdoor

Key points

• Researchers at Blackpoint Cyber have documented two previously unseen tools, a loader called HollowFrame and a backdoor called Matryoshka, used against a law firm.
• The attack started with a spear-phishing email, a targeted message crafted for a specific person, containing a link to an encrypted archive.
• Inside the archive was a Windows Shortcut file (an LNK) that kicked off a multi-stage infection chain when opened.
• HollowFrame is written in Go and Matryoshka is written in Rust, two modern programming languages increasingly favoured by attackers to slow down analysis.
• Law firms hold sensitive client material, which makes them a repeat target for espionage-style intrusions.

A law firm has become the test case for two new pieces of attacker software that had not been publicly named before this week.

The tools are called HollowFrame, a loader (the small program that pulls in the real malware), and Matryoshka, a backdoor (software that gives an intruder remote control of a computer). Both were spotted by researchers at Blackpoint Cyber, whose findings were first written up by The Hacker News.

In practice, this is the kind of quiet, targeted intrusion that never makes the evening news but ends with client files sitting on a server somewhere in another country.

How did the attackers get in?

Through email. Someone at the firm received a spear-phishing message, meaning a fake email written specifically for them rather than blasted out to thousands of people.

The email carried a link. That link pointed to an encrypted archive, a password-protected zip-style file, which is a common trick to slip past email scanners that cannot see inside.

Inside the archive sat a Windows Shortcut file, the same kind of icon you double-click to open a program. Opening it did not launch anything the victim expected. It quietly ran a chain of commands that pulled in the next stage.

The failure mode here is familiar: one click, one shortcut, and the rest happens without the user seeing a thing.

What do HollowFrame and Matryoshka actually do?

HollowFrame is the delivery van. Matryoshka is the cargo.

HollowFrame's job is to run on the machine, stay hidden, and fetch the real payload. Written in Go, a language built by Google, it produces files that are bulky and awkward for older antivirus tools to pick apart.

Matryoshka is the backdoor that lands after HollowFrame does its work. Written in Rust, another modern language, it gives the attackers a way to run commands, move files, and dig further into the network at their own pace.

The name is a nod to Russian nesting dolls, which fits: the malware unpacks itself in layers, each one revealing the next.

Should ordinary people be worried?

Not directly, but clients of the firm might be. Law firms hold divorce papers, contracts, medical records, and corporate deal memos. A backdoor sitting on a partner's laptop is a leak waiting to happen.

If you have used a law firm recently and receive an unusual message referring to your case, especially one asking you to click a link or confirm details, phone the firm on a number you already have. Do not use contact details from the email itself.

What the post-mortem will say

One thing the post-mortem will say is that the shortcut file should never have been able to run from an archive downloaded via a link in an email.

Group Policy on Windows can block LNK files from launching scripts. Email gateways can strip or quarantine password-protected archives. Endpoint tools can flag Go and Rust binaries writing to user profile directories. None of this is exotic. It is just work that tends to sit at the bottom of someone's Jira board.

Operational takeaway: if your users can double-click their way from an inbox to arbitrary code execution, the language the malware is written in barely matters.