HollowFrame masks malware behind trusted Python files

A newly identified malware operation has used a counterfeit Python component to bypass security scrutiny, disable parts of Microsoft Defender and establish persistent remote access inside a law firm’s network.

The intrusion compromised two endpoints after employees received spear-phishing emails directing them to an encrypted archive hosted on the Mega file-sharing service. The archive contained a malicious Windows shortcut named “Case Documents”, designed to resemble material connected with legal work.

Opening the shortcut triggered a multi-stage infection chain involving native Windows utilities, obfuscated PowerShell commands, legitimate signed applications and encrypted payloads. Researchers have named the previously undocumented Go-based loader HollowFrame and the accompanying Rust-based backdoor family Matryoshka.

The initial shortcut wrote encoded data into temporary files and used the Windows certutil utility to decode the next command stage. PowerShell then connected to an attacker-controlled server, sought administrative privileges and relaunched itself through a hidden elevated process when necessary.

The script created a directory that appeared to contain a Python 3.11 installation and added Microsoft Defender exclusions for both the folder and the python. exe process. These changes were made before the malicious executable files arrived, reducing security inspection of components subsequently placed in the directory.

A compressed package labelled Python-3.11.0-embed-amd96. zip was then downloaded over an unencrypted HTTP connection. The unusual “amd96” suffix distinguished it from an authentic Python embedded distribution, although the archive included a legitimate python. exe file and a valid Microsoft runtime library.

The central deception involved python311. dll, which would normally contain the standard Python runtime. The substituted file was instead a 64-bit Go library carrying malicious code. It exported only four Python-compatible function names, including Py_Main, which was sufficient to satisfy the legitimate executable and redirect execution into HollowFrame.

This DLL side-loading technique allowed the attackers to place hostile code beside a trusted executable that automatically searched its local directory for the required library. Running python. exe therefore activated the fake DLL without launching a Python script, module or command-line console.

HollowFrame contained an encrypted region of more than six million bytes. The loader selected alternating bytes from the stored data, decrypted the resulting content with XChaCha20-Poly1305 and decompressed it to recover an executable payload. Interspersed unused bytes added structural noise that complicated straightforward extraction and static inspection.

The recovered framework supported several execution methods, including process ghosting, module stomping, manual executable mapping, shellcode execution and file-based launching. That flexibility could allow an operator to change techniques between machines, producing different signals across affected endpoints.

HollowFrame also checked whether it was running inside an analysis environment. Its tests examined system uptime, installed memory, the number of files in the user profile and cursor movement. Systems failing the checks produced a message indicating that the environment resembled a sandbox, after which the malware stopped running.

Persistence options included a scheduled task activated at user logon with the highest privileges and a 30-second delay. The framework could also create permanent Windows Management Instrumentation event subscriptions or place files inside the Startup folder.

An additional encrypted container delivered Matryoshka through another side-loading chain involving a legitimate Microsoft OneDrive updater executable. A malicious version. dll placed beside the updater enabled the backdoor’s network and command activity to appear under a familiar Microsoft process.

One Matryoshka variant communicated with an external server over plain HTTP, providing command execution and the ability to deploy additional tools. A second variant used a private GitHub repository as its command-and-control channel.

The GitHub-based implant assigned each compromised machine a directory named with the computer and user identity. Files inside those directories carried beaconing data, commands, results and uploaded payloads, effectively turning the repository into a collection of individual mailboxes for infected endpoints.

This approach allowed the attackers to conduct reconnaissance, transfer files and issue machine-specific instructions through a widely trusted cloud platform. It also reduced dependence on dedicated command servers that could be blocked or seized, although repository activity could leave a versioned history unless commits were removed.

The combined toolset gave the unidentified operator the capacity to examine Active Directory, execute remote commands and install follow-on malware. Those functions could support credential theft, movement between systems and wider compromise of an organisation’s domain.