Attackers Built a Trusted Execution Lane Before the Malware Even Landed
A previously undocumented loader framework is making the rounds, and it has a clever trick: it disguises Go code inside a counterfeit Python runtime. The kicker? It first tells Microsoft Defender to look the other way.
Researchers at Blackpoint Cyber’s Adversary Pursuit Group (APG) published their findings on July 30. The intrusion hit two endpoints at a law firm and deployed two never-before-seen families: a Go loader they call HollowFrame and a pair of Rust backdoors dubbed Matryoshka.
From Phishing Email to Defender Exclusions
The attack chain started with a spear phishing email sent to several staff members. A link in the message routed recipients through an attacker-controlled redirector to an encrypted archive hosted on Mega. Inside sat a shortcut file named Case Documents.lnk.
Executing that shortcut wrote Base64 content to a temporary file, rebuilt a script using the built-in certutil utility, and then launched an obfuscated PowerShell chain that prompted the user for administrator rights.
Once elevated, that stage created Defender exclusions covering both a staging directory and the process name python.exe. Only then did it begin downloading executable content. Blackpoint said the actor had “effectively prepared a trusted looking execution lane” before the loader arrived.
The archive it retrieved was named to resemble an official Python embedded distribution, though the filename read amd96 rather than amd64. A small typo, but a telling one.
Python in Name Only
Launching the bundled python.exe with no script or module argument moved the chain into DLL sideloading territory.
The accompanying python311.dll was not CPython. It was a 64-bit Go library exporting just four Python-compatible function names — enough to satisfy the host’s import requirement and hand execution to malicious Go code.
That code was HollowFrame, a modular loader with several execution methods at its disposal:
- Process ghosting
- Module stomping
- Manual PE mapping
This flexibility means the same framework can generate different telemetry on different endpoints, making detection and correlation harder for defenders.
HollowFrame also checked system uptime, installed memory, and cursor movement before running. It offered three persistence routes: a scheduled task, a WMI event subscription tied to new logon sessions, and the Startup folder.
A Dead Drop on GitHub
HollowFrame dropped a native loader that sideloaded a malicious version.dll beside a legitimate OneDrive updater. That placed the first Matryoshka backdoor’s command execution and network traffic inside a trusted Microsoft process.
A second variant, a Rust wtsapi32.dll proxying 41 Windows Terminal Services exports, used GitHub instead. Each victim was assigned a directory in a private repository holding beacon, command, and result files. The operator got tasking and file transfer without running a custom C2 server.
Beyond shell access, this variant could:
- Identify domain controllers
- Enumerate domain computers and privileged group membership
- Inventory network configuration, local privileges, and installed software
Its requests carried a OneDrive user agent, which Blackpoint listed as a detection indicator. For more on this technique, see GitHub used as a covert channel in multi-stage malware campaigns.
Detection and Mitigation Advice
Blackpoint’s recommendations include correlating unexpected GitHub API connections from non-browser processes with requests for tasking files, and flagging signed binaries that load adjacent DLLs from user-writable paths.
The firm also advised:
- Constraining GitHub API access from endpoints with no development role
- Reviewing scheduled tasks and WMI subscriptions for update-themed names
- Detonating password-protected archives and shortcut files in a controlled environment
This attack shows how attackers are getting more creative with execution chains. The fake Python DLL is a neat piece of social engineering aimed at the operating system itself. And the GitHub dead drop? That’s a free, legitimate-looking C2 channel that’s hard to block without breaking developer workflows.
For defenders, the key is to watch for the anomalies: unexpected Defender exclusions, Python processes doing non-Python things, and GitHub API calls from processes that have no business being there.
