Malware

Matryoshka

Matryoshka is a Rust-based Windows backdoor family observed in a multi-stage intrusion chain in which a Go-based loader framework deployed the final implant through DLL sideloading and reflective DLL injection. It has been documented in at least two variants: one using direct HTTP command-and-control and another using a private GitHub repository as a dead-drop channel for beaconing, tasking, result submission, file transfer, reconnaissance, and secondary payload delivery. The malware has been associated with an intrusion targeting a law firm, where it was delivered after a spearphishing-triggered loader sequence that abused a shortcut file, PowerShell, staged payload retrieval, and a fake embedded Python environment.

Matryoshka provides persistent remote access and post-compromise control. Reported capabilities include command execution, shell access, screen capture, file transfer, secondary payload delivery, and Outlook password theft. The GitHub-backed variant also performs host and Active Directory reconnaissance, including identifying domain controllers, enumerating domain computers and privileged group membership, and collecting network configuration, local privilege, and installed software information. The malware has been observed executing within trusted Windows processes and using sideload hosts to blend malicious activity with legitimate software behavior.

For persistence, Matryoshka has been observed creating Registry Run entries and scheduled tasks with legitimate-looking names. For execution and evasion, it uses reflective DLL injection to load a malicious library and run the RAT in memory. The broader intrusion chain also established Microsoft Defender exclusions before downloading later stages, indicating deliberate defense evasion in the surrounding deployment workflow. The threat actor behind the observed activity remains unknown.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

31 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.002Spearphishing LinkEvidence4

The chain began with a spear phishing email sent to several staff. A link routed recipients through an attacker-controlled redirector to an encrypted archive hosted on Mega, containing a shortcut file named Case Documents.lnk.

Execution

6 techniques

T1053Scheduled Task/JobEvidence1

Persistence is achieved through scheduled tasks.

T1053.005Scheduled TaskEvidence3

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

T1059Command and Scripting InterpreterEvidence2

placing the first Matryoshka backdoor's command execution and network traffic inside a trusted Microsoft process.

T1059.001PowerShellEvidence2

Executing it wrote Base64 content to a temporary file, rebuilt a script using the built-in certutil utility, then launched an obfuscated PowerShell chain that prompted the user for administrator rights.

T1059.003Windows Command ShellEvidence1

Running it launched a command chain that wrote Base64 content into %TEMP%\sgrfm.b64 , created %TEMP%\sgrfm.cmd...

T1204.002Malicious FileEvidence3

The LNK file mimicked to be Case Documents to lure the victim into opening and triggering a command sequence

Persistence

4 techniques

T1053Scheduled Task/JobEvidence1

Persistence is achieved through scheduled tasks.

T1053.005Scheduled TaskEvidence3

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

T1547.001Registry Run Keys / Startup FolderEvidence1

ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.

T1547.009Shortcut ModificationEvidence1

A link routed recipients through an attacker-controlled redirector to an encrypted archive hosted on Mega, containing a shortcut file named Case Documents.lnk. Executing it wrote Base64 content to a temporary file, rebuilt a script using the built-in certutil utility, then launched an obfuscated PowerShell chain

Privilege Escalation

7 techniques

T1053Scheduled Task/JobEvidence1

Persistence is achieved through scheduled tasks.

T1053.005Scheduled TaskEvidence3

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

T1055Process InjectionEvidence1

Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

T1055.012Process HollowingEvidence1

Matryoshka ... After downloading the first-stage payload, it runs the second-stage malware via its dropper and installs the real payload. It uses the process hollowing technique to evade defenses.

T1547.001Registry Run Keys / Startup FolderEvidence1

T1547.009Shortcut ModificationEvidence1

T1548.002Bypass User Account ControlEvidence2

then launched an obfuscated PowerShell chain that prompted the user for administrator rights. Once elevated, that stage created Defender exclusions

Stealth

6 techniques

T1027Obfuscated Files or InformationEvidence1

Running it launched a command chain that wrote Base64 content into %TEMP%\sgrfm.b64...

T1036MasqueradingEvidence2

The archive it retrieved was named to resemble an official Python embedded distribution, though the filename read amd96 rather than amd64.

T1055Process InjectionEvidence1

T1055.012Process HollowingEvidence1

Matryoshka ... After downloading the first-stage payload, it runs the second-stage malware via its dropper and installs the real payload. It uses the process hollowing technique to evade defenses.

T1218.010Regsvr32Evidence1

Running it launched a command chain that wrote Base64 content into %TEMP%\sgrfm.b64 , created %TEMP%\sgrfm.cmd , used certutil.exe -decode...

T1620Reflective Code LoadingEvidence1

Cobalt Strike has the ability to load DLLs via reflective injection... Lazarus Group malware sample performs reflective DLL injection... Matryoshka uses reflective DLL injection... Netwalker DLL has been injected reflectively into the memory of a legitimate running process.

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

Once elevated, that stage created Defender exclusions covering both a staging directory and the process name python.exe

Discovery

8 techniques

T1016System Network Configuration DiscoveryEvidence1

and inventory network configuration, local privileges and installed software.

T1018Remote System DiscoveryEvidence2

Beyond shell access, the variant could identify domain controllers, enumerate domain computers and privileged group membership

T1033System Owner/User DiscoveryEvidence1

and inventory network configuration, local privileges and installed software.

T1069.002Domain GroupsEvidence1

Beyond shell access, the variant could identify domain controllers, enumerate domain computers and privileged group membership

T1082System Information DiscoveryEvidence1

another leveraging a private GitHub repository for C2 communication, tasking, reconnaissance, and file transfer.

T1083File and Directory DiscoveryEvidence1

These capabilities could support credential theft, lateral movement, and broader domain compromise

T1482Domain Trust DiscoveryEvidence1

Beyond shell access, the variant could identify domain controllers, enumerate domain computers and privileged group membership

T1518Software DiscoveryEvidence1

and inventory network configuration, local privileges and installed software.

Collection

1 technique

T1113Screen CaptureEvidence1

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

Command and Control

2 techniques

T1071.001Web ProtocolsEvidence3

Each victim was assigned a directory in a private repository holding beacon, command and result files, giving the operator tasking and file transfer without a custom C2 server.

T1105Ingress Tool TransferEvidence4

Each victim was assigned a directory in a private repository holding beacon, command and result files, giving the operator tasking and file transfer without a custom C2 server.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

uses a private GitHub repository for polling target-specific commands, submitting results, and fetching payloads

Other

2 techniques

T1562Impair DefensesEvidence3

Once elevated, that stage created Defender exclusions covering both a staging directory and the process name python.exe, and only then began downloading executable content.

T1562.001Disable or Modify ToolsEvidence1

Check Microsoft Defender exclusions. A new exclusion for a Python folder or python.exe is more serious than the presence of Python by itself.

INDICATORS OF COMPROMISE

IOCs tracked for this family

7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app14 days ago

ip.v4●●●●●●●●●●●●View more in app16 days ago

uri●●●●●●●●●●●●View more in app17 days ago

domain●●●●●●●●●●●●View more in app17 days ago

hash.sha256●●●●●●●●●●●●View more in app17 days ago

ACTIVITY FEED

Recent activity

30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

30 SOURCESView more in app

infosecurity magazine newsNews

Aug 3, 2026

HollowFrame Loader Uses Fake Python DLL to Evade Defender - Infosecurity Magazine

A pair of Rust backdoor variants delivered by HollowFrame. One variant is sideloaded through a malicious version.dll beside a legitimate OneDrive updater to hide execution in a trusted Microsoft process. Another variant uses a wtsapi32.dll proxy and GitHub as a dead-drop C2 channel with per-victim directories for beaconing, commands, results, and file transfer. It supports shell access, domain controller discovery, domain and privilege enumeration, and host/network inventory.

cysecurity newsNews

Aug 2, 2026

HollowFrame Loader and Matryoshka Malware Used in Spear-Phishing Attack - CySecurity News - Latest Information Security and Hacking Incidents

A Rust-based backdoor with two observed variants: one using HTTP C2 and another using a private GitHub repository for C2. It enables remote command execution, beaconing, reconnaissance, file transfer, shell spawning, and delivery of secondary payloads.

trojan killer newsNews

Aug 1, 2026

HollowFrame and Matryoshka Backdoor: Check Python DLL Sideloading

A Windows backdoor in the reported intrusion chain, associated with document-lure phishing, PowerShell staging, Defender exclusion changes, staged Python files, and persistent remote-access behavior.

scworldNews

Jul 31, 2026

New HollowFrame loader and Matryoshka malware family discovered | brief | SC Media

A Rust-based backdoor malware family with at least two variants. It supports C2 over HTTP or via a private GitHub repository and is used for tasking, reconnaissance, and file transfer as part of a modular, multi-stage attack chain.

+26 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching7

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping31

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Matryoshka