New Malware Pair Targets Law Firm in Spear-Phishing Campaign

Security researchers discovered a spear-phishing campaign that deployed two undocumented malware families to compromise a law firm [1, 2].

This discovery highlights a growing trend of attackers utilizing niche programming languages to evade detection. By combining Go and Rust, the actors created a multi-stage infection chain that bypassed standard security signatures on the targeted systems.

Blackpoint Cyber's Adversary Pursuit Group (APG) identified the attack after finding two compromised endpoints at an unnamed law firm ^[2]. The campaign began with spear-phishing emails designed to trick users into executing a malicious payload.

Researchers said the attack utilized a Go-based loader known as HollowFrame ^[1]. This loader employed DLL side-loading techniques to execute its payload, masquerading as a fake Python DLL to avoid suspicion from system administrators ^[2].

Once HollowFrame established a foothold, it deployed a second piece of malware: a Rust-based backdoor called Matryoshka ^[1]. The use of Rust is particularly notable because the language provides high performance and memory safety, which can make the resulting binaries more difficult for traditional antivirus tools to analyze ^[1].

The Matryoshka backdoor communicated with a command-and-control server hosted on GitHub ^[1]. By using a legitimate platform like GitHub for communication, the attackers attempted to blend their malicious traffic with normal web activity, a tactic known as "living off trusted sites," to avoid triggering network alerts ^[1].

Researchers said the deployment of these two undocumented families ^[1] suggests a sophisticated operation. The attackers targeted a specific professional services firm, which often hold sensitive client data, though the full extent of the data breach remains unclear ^[2].