Actor Profile

The threat actor behind this campaign remains unattributed. The operation demonstrates sophisticated tradecraft, deploying a previously undocumented Go-based loader framework (HollowFrame) and a Rust-based backdoor (Matryoshka) in targeted spear-phishing attacks against legal services. The actor's motivation appears to be establishing persistent access for credential theft, Active Directory reconnaissance, and potential domain compromise. The use of GitHub as C2 infrastructure and modular, multi-stage infection chains suggests an adversary with operational security awareness and development capability across multiple programming languages. A GitHub account (adioziaete) associated with the C2 infrastructure was created on January 6, 2023, with profile updates as recent as June 7, 2026, indicating sustained operational activity.

TTPs (Tactics, Techniques, Procedures)

The attack chain leverages spear-phishing (T1566) with malicious LNK files (T1204.002) masquerading as "Case Documents." Initial execution uses PowerShell (T1059.001) to fetch payloads from remote infrastructure (2.26.252[.]84). Persistence is established via scheduled tasks (T1053.005). The actor employs DLL side-loading (T1574.002) using legitimate Python binaries (python.exe) with rogue DLLs (python311.dll) to load HollowFrame. Defense evasion includes weakening Microsoft Defender protections (T1562.001) and anti-analysis checks based on system uptime, memory, file count, and cursor movement (T1497). HollowFrame deploys Matryoshka backdoor via a second side-loading chain (version.dll). C2 communication occurs over HTTP (T1071.001) to 45.158.196[.]184:8888 and via GitHub repositories (T1102.001) using per-host mailbox directories. Capabilities include command execution (T1059), Active Directory reconnaissance (T1018), file transfer (T1105), and secondary payload delivery supporting credential theft and lateral movement.

Targets & Patterns

The campaign specifically targets the legal services sector, with at least one confirmed intrusion affecting two endpoints at a law firm. Law firms represent high-value targets due to their access to sensitive client information, intellectual property, privileged communications, and financial data. The use of lures themed as "Case Documents" demonstrates social engineering tailored to legal professionals' workflows. The deployment of Active Directory reconnaissance capabilities and lateral movement tooling suggests the actor's objective extends beyond single-endpoint compromise to broader domain infiltration. This targeting pattern may indicate espionage motivations, pre-ransomware reconnaissance, or attempts to access confidential legal proceedings and client data for competitive intelligence or extortion purposes.

Historical Context

HollowFrame and Matryoshka are both previously undocumented malware families first disclosed by Blackpoint Cyber in July 2026. No direct links to known APT groups or prior campaigns have been established. The GitHub account (adioziaete) used for C2 infrastructure was created in January 2023, suggesting the actor may have been conducting preparatory infrastructure development or earlier unreported operations for approximately three years before this disclosure. The use of GitHub as C2 infrastructure follows a broader trend observed in multiple threat actor operations seeking to blend malicious traffic with legitimate cloud services. The modular, multi-stage infection design with deliberate separation of malicious logic across components represents an evolution in OPSEC practices aimed at complicating attribution and detection.

Defensive Recommendations

  • Monitor for suspicious LNK file execution followed by PowerShell network connections (T1059.001). Detect via Sysmon Event ID 1 correlating shortcut execution with child PowerShell processes making outbound connections.
  • Implement application whitelisting and scrutinize DLL side-loading attempts involving python.exe, python311.dll, version.dll, and wtsapi32.dll in non-standard directories (T1574.002).
  • Detect scheduled task creation for persistence (T1053.005) via Windows Event ID 4698 and correlate with recently downloaded executables or DLLs from external sources.
  • Monitor for unauthorized modifications to Microsoft Defender settings (T1562.001) via registry changes, PowerShell cmdlets (Set-MpPreference), or Group Policy alterations.
  • Establish behavioral detection for GitHub API access patterns from endpoints, particularly repository operations involving beacon.json, cmd.json, result.json files or per-host directory structures (T1102.001).
  • Implement network monitoring for connections to known malicious infrastructure (2.26.252[.]84, 45.158.196[.]184:8888) and inspect HTTP traffic for C2 beaconing patterns.
  • Deploy anti-analysis countermeasures awareness: monitor for processes checking system uptime, memory size, user profile file counts, or cursor position as potential malware environmental checks (T1497).