HollowFrame

First Observed: July 23, 2026

Threat Type: Execution Framework

Platform: Windows

Confidence: High

Aliases and Related Activity:

• Carries and deploys loader_panda.exe, a dropper for the Matryoshka HTTP backdoor
• Matryosha (HTTP only): a malware family that includes two distinct Rust based backdoor variants.

HollowFrame is a previously undocumented, multi-stage Go based loader and persistence framework. The attack begins with a spear phishing email directing recipients through an attacker-controlled redirector to a Mega hosted encrypted archive containing a malicious Windows shortcut. Executing the shortcut initiates a certutil based decode chain that launches XOR obfuscated PowerShell, which requests elevation, adds Microsoft Defender exclusions for a staged Python path and python.exe, then downloads a trojanized Python embedded distribution. The archive contains a legitimate python.exe alongside a malicious Go DLL exporting four Python compatible symbols to satisfy python.exe’s import requirement, which decrypts and loads the HollowFrame Go execution framework entirely in memory using XChaCha20-Poly1305.

HollowFrame supports multiple evasive execution methods, sandbox anti-analysis gates, and persistence mechanisms including scheduled task, WMI event subscription, and Startup folder. It also carries an embedded encrypted container housing loader_panda.exe, the dropper responsible for deploying the Matryoshka HTTP backdoor.

HollowFrame activity maps to the following MITRE ATT&CK techniques observed by the Blackpoint Adversary Pursuit Group (APG).

Blackpoint APG observed HollowFrame alongside the following tooling, related families, and legitimate software abused during the intrusion chain.

Organizations investigating potential HollowFrame activity should review the following indicators identified by Blackpoint APG.

• Monitor for python.exe or similar trusted runtimes launched from user-writable paths (%TEMP%, %APPDATA%, %LOCALAPPDATA%) that load adjacent DLLs (e.g., python311.dll) not present in the original Python installation directory.
• Alert on certutil.exe invoked with -decode arguments operating on files written to %TEMP% by non-administrative or script-spawned processes, particularly when followed closely by a PowerShell execution with Invoke-Expression.
• Treat PowerShell Defender exclusion commands (Add-MpPreference -ExclusionPath / -ExclusionProcess) issued from a non-administrative or downloaded script as a high-severity indicator requiring immediate triage.
• Detect and review scheduled tasks with on-logon triggers, highest-privilege settings, and payload paths pointing into %LOCALAPPDATA% or %TEMP% directories, particularly those whose names resemble legitimate update or maintenance tasks.
• Hunt for WMI CommandLineEventConsumer activity under root\subscription triggered by Win32_LogonSession events. Flag filter, consumer, and binding objects whose names were recently recreated or reuse generated naming patterns.
• Restrict or inspect password-protected archives and shortcut files (.lnk) delivered from external file sharing platforms such as Mega. Ensure .lnk files trigger-controlled detonation before reaching end users.
• Retain and review PowerShell Script Block Logging and command line telemetry. XOR-obfuscated in-memory scripts that call Invoke-Expression will appear in Script Block Logs even when not written to disk.

For a deeper analysis of HollowFrame, read Blackpoint Cybers Nested Trust: HollowFrame’s Layered Loader and Matryoshka Backdoors.