A previously undocumented loader framework has been found disguising Go code inside a counterfeit Python runtime, after first instructing Microsoft Defender to ignore the directory and the process it was about to abuse.
According to new research from Blackpoint Cyber’s Adversary Pursuit Group (APG), published on July 30, the intrusion hit two endpoints at a law firm and deployed two undocumented families: a Go loader tracked as HollowFrame and a pair of Rust backdoors tracked as Matryoshka.
Exclusions Before Payloads
The chain began with a spear phishing email sent to several staff. A link routed recipients through an attacker-controlled redirector to an encrypted archive hosted on Mega, containing a shortcut file named Case Documents.lnk.
Executing it wrote Base64 content to a temporary file, rebuilt a script using the built-in certutil utility, then launched an obfuscated PowerShell chain that prompted the user for administrator rights.
Once elevated, that stage created Defender exclusions covering both a staging directory and the process name python.exe, and only then began downloading executable content. Blackpoint said the actor had “effectively prepared a trusted looking execution lane” before the loader arrived.
The archive it retrieved was named to resemble an official Python embedded distribution, though the filename read amd96 rather than amd64.
Python in Name Only
Launching the bundled python.exe with no script or module argument moved the chain into DLL sideloading.
The accompanying python311.dll was not CPython. It was a 64-bit Go library exporting just four Python-compatible function names, enough to satisfy the host’s import requirement and hand execution to malicious Go code.
That code was HollowFrame, a modular loader offering several execution methods including process ghosting, module stomping and manual PE mapping, so the same framework could generate different telemetry on different endpoints.
It also checked uptime, installed memory and cursor movement before running and offered three persistence routes: a scheduled task, a WMI event subscription tied to new logon sessions and the Startup folder.
A Dead Drop on GitHub
HollowFrame dropped a native loader that sideloaded a malicious version.dll beside a legitimate OneDrive updater, placing the first Matryoshka backdoor’s command execution and network traffic inside a trusted Microsoft process.
A second variant, a Rust wtsapi32.dll proxying 41 Windows Terminal Services exports, used GitHub instead. Each victim was assigned a directory in a private repository holding beacon, command and result files, giving the operator tasking and file transfer without a custom C2 server.
Beyond shell access, the variant could identify domain controllers, enumerate domain computers and privileged group membership and inventory network configuration, local privileges and installed software. Its requests carried a OneDrive user agent, which Blackpoint listed as a detection indicator.
Read more on GitHub C2 abuse: GitHub Used as Covert Channel in Multi-Stage Malware Campaign
Blackpoint’s recommendations include correlating unexpected GitHub API connections from non-browser processes with requests for tasking files and flagging signed binaries that load adjacent DLLs from user-writable paths.
The firm also advised constraining GitHub API access from endpoints with no development role, reviewing scheduled tasks and WMI subscriptions for update-themed names and detonating password-protected archives and shortcut files in a controlled environment.
