HollowFrame Uses a Layered Loader to Deploy Matryoshka Backdoors

Summary

Blackpoint Cyber uncovered a sophisticated multi-stage intrusion involving the Go-based HollowFrame loader and Rust-based Matryoshka backdoors. The attack relies on layered obfuscation and DLL sideloading through legitimate Python and OneDrive components to establish persistent remote access. The campaign deliberately fragments malicious activity across trusted binaries and cloud services to reduce visibility and evade detection.

Investigation

Blackpoint Cyber’s Adversary Pursuit Group investigated an intrusion affecting two endpoints at a law firm. Analysts reconstructed an attack chain beginning with a spearphishing email and a password-protected archive hosted on Mega, followed by execution of a malicious .lnk file. The research showed how the actor used XOR-obfuscated PowerShell, staged Python environments, and DLL sideloading to deploy modular malware components.

Mitigation

Organizations should strengthen controls around password-protected archives and suspicious .lnk files. Application control policies should restrict GitHub API access from endpoints that do not require development services and detect signed binaries loading DLLs from user-writable directories. Limiting unsigned or heavily obfuscated PowerShell execution can also reduce exposure to the initial attack stages.

Response

If HollowFrame or Matryoshka activity is detected, responders should hunt for GitHub-based tasking by correlating api.github.com connections originating from non-browser processes. Investigations should prioritize instances of cmd.exe or powershell.exe launched by unusual parent processes, including Python components and OneDrive updaters. Scheduled tasks, WMI subscriptions, and Startup-folder modifications should also be reviewed for persistence.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary aims to execute a malicious payload while minimizing visibility to the end-user and bypassing local execution restrictions. To achieve this, the attacker uses a “Living-off-the-Land” approach, invoking powershell.exe with the -ExecutionPolicy Bypass flag to ignore script restrictions and -WindowStyle Hidden to prevent a console window from appearing. To execute the final stage of the payload without writing a script to disk, the attacker uses Invoke-Expression (IEX) to run a command string directly in memory, effectively bypassing many file-based scanners.

• Regression Test Script:

  # Simulation Script: Triggering PowerShell Obfuscation and Bypass Flags
  # This script simulates an adversary attempting to bypass policy and execute via IEX.
  
  Write-Host "[+] Starting Simulation: Triggering Detection Rule..." -ForegroundColor Cyan
  
  # Execution 1: Triggering selection_flags (Bypass and Hidden)
  Write-Host "[*] Executing command with Bypass and Hidden flags..."
  Start-Process powershell.exe -ArgumentList "-ExecutionPolicy Bypass -WindowStyle Hidden -Command 'Write-Output Triggering_Flags'" -WindowStyle Hidden
  
  # Execution 2: Triggering selection_obfuscation (IEX/Invoke-Expression)
  Write-Host "[*] Executing command with IEX obfuscation..."
  powershell.exe -Command "IEX ('Write-Output ' + 'Triggering_Obfuscation')"
  
  Write-Host "[+] Simulation Complete. Check SIEM for alerts." -ForegroundColor Green

• Cleanup Commands:

  # No persistent files are created by this simulation. 
  # No cleanup required.
  Write-Host "[+] No artifacts to clean up." -ForegroundColor Cyan