Loading story…
A previously unreported intrusion at a law firm used spear-phishing emails to lure victims into opening a Mega-hosted encrypted archive containing a malicious Windows shortcut disguised as case documents. The shortcut launched obfuscated PowerShell, reduced Microsoft Defender protections, and staged a fake Python environment for DLL sideloading, where a rogue python311.dll loaded through a legitimate python.exe decrypted and executed a Go-based loader framework dubbed HollowFrame.
Blackpoint Cyber said HollowFrame supported multiple execution methods, anti-analysis checks, and persistence through mechanisms including scheduled tasks, WMI event subscriptions, and Startup-folder deployment before delivering the Rust-based Matryoshka malware family. Investigators observed both an HTTP command-and-control variant and a GitHub-backed variant that used the GitHub Contents API and a private repository for victim-specific tasking, reconnaissance, file transfer, and payload delivery, giving the attacker persistent remote command execution and Active Directory visibility that could enable credential theft, lateral movement, and wider domain compromise.
Pull IOCs and campaign context straight into your stack.
4 events from the most recent confirmed update back to the earliest known activity.
On July 30, 2026, Blackpoint Cyber's Adversary Pursuit Group published research detailing the HollowFrame Go-based loader and Matryoshka Rust backdoors used in a law firm intrusion. The report disclosed the fake Python embedded distribution and malicious python311.dll sideloading chain, Defender exclusion abuse, persistence methods, and the private GitHub dead-drop C2 variant.
The GitHub profile associated with the private adioziaete/memio repository was updated as recently as June 7, 2026, indicating continued maintenance of infrastructure later linked to the malware.
The GitHub account associated with the private repository adioziaete/memio, later used by the Matryoshka GitHub variant for command-and-control, was created on January 6, 2023.
Blackpoint Cyber's Adversary Pursuit Group identified a previously undocumented multi-stage intrusion affecting two endpoints at a law firm. The attack used spear phishing, the Go-based HollowFrame loader framework, and the Rust-based Matryoshka malware family to establish persistence and remote access.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 16 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
infosecurity-magazine.com
Open sourcecysecurity.news
Open sourcetrojan-killer.net
Open sourcescworld.com
Open sourcethehackernews.com
Open sourceblackpointcyber.com
Open sourcesupport.microsoft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported renewed activity involving **Matanbuchus**, a **malware-as-a-service** loader sold on Russian-speaking cybercrime forums, where it has been advertised for rent at roughly **$2,500**. In observed campaigns, attackers used phishing emails carrying ZIP attachments that led victims through a multistage infection chain: an HTML file dropped another ZIP archive containing an MSI installer, which wrote a DLL and VBS file to disk and invoked `regsvr32.exe` to execute the malicious DLL. The loader then performed anti-analysis checks, created persistence through a scheduled task, and contacted command-and-control infrastructure to retrieve its next-stage payload directly in memory. Technical analyses showed that Matanbuchus uses obfuscated and encrypted strings, API hashing based on **FNV1a**, and HTTP communications to download follow-on malware while minimizing disk artifacts. Researchers linked the loader to deployments of **Cobalt Strike Beacons** and noted overlap with phishing operations involving other malware such as **Qakbot**. Reverse-engineering work also identified multiple infrastructure domains, sample hashes, and distinct loader and payload components, while updated **YARA** rules and configuration extractors improved detection of newer variants.
Aug 15, 2026
Multiple recent intrusion reports describe **phishing-led Windows compromises** that rely on **weaponized `.LNK` shortcuts** to trigger **obfuscated PowerShell** execution, display decoy documents, and then fetch additional payloads from public cloud/code platforms. In South Korea, attackers distributed an LNK disguised as financial trading guidance that opens a decoy PDF while running PowerShell; subsequent stages perform anti-analysis/virtualization checks, establish persistence, and retrieve a masked executable from **GitHub** that decrypts code at runtime to run **MoonPeak** malware. Researchers assessed the activity as likely **North Korea–linked** based on GitHub commit metadata and naming patterns. A separate Russia-targeted campaign used business-themed archives containing decoy documents and a malicious LNK to pull a PowerShell loader that establishes persistence and then weakens defenses (including **Microsoft Defender exclusion changes** and use of **`defendnot`**), performs reconnaissance, and tampers with system tooling and file associations before deploying **Amnesia RAT** (fetched from **Dropbox**) and a **Hakuna Matata–derived ransomware** payload for encryption. By contrast, reporting on **KazakRAT** describes a different espionage operation in Kazakhstan/Afghanistan delivered via malicious **MSI** installers and using simple, unencrypted HTTP C2; it is not part of the LNK/PowerShell delivery chains described in the other incidents.
Jun 29, 2026
Researchers documented several **multi-stage malware campaigns** that used phishing lures, fake software updates, and DLL sideloading to deploy credential theft and remote access payloads. In one June 2026 intrusion targeting a small number of German financial institutions, a spear-phishing email posing as an urgent VPN update delivered a 7-Zip self-extracting archive that dropped a signed copy of **Radmin VPN** alongside a trojanized `Qt5Core.dll`, launching **HijackLoader** and ultimately **Vidar v2.1** through process hollowing into a signed `dBpoweramp` binary. A parallel chain used Opera sideloading to install **SnappyClient RAT**. Separate reporting also described a targeted Spanish-language phishing lure that delivered a password-protected archive containing a .NET loader and a byte-reversed DLL payload, as well as a fake browser update chain that used a signed **G DATA AntiVirus** binary to sideload **PlugX** linked to suspected **Mustang Panda** activity. Across the cases, the malware families showed strong emphasis on **credential theft, stealth, and layered execution**. Vidar samples were observed harvesting browser passwords, cookies, screenshots, FileZilla and WinSCP data, and cryptocurrency wallet information, while also bypassing Chromium App-Bound Encryption by launching legitimate Chrome and Edge instances with specific flags and using dead-drop resolvers such as **Steam** and **Telegram** to locate command-and-control servers. The PlugX implant used multiple decoding and encryption layers, manual PE mapping, registry-based persistence, and WinHTTP communications to `fruitbrat[.]com:443`, while another credential-stealing sample tied in open sources to **RedFoxtrot** targeted Firefox and Internet Explorer data and used proxy-aware HTTP communications with hardcoded infrastructure. The reporting highlights continued attacker reliance on signed binaries, staged loaders, and obfuscated payload handling to evade detection while stealing credentials and enabling follow-on access.
Jul 12, 2026