Matryoshka

First Observed: July 23, 2026

Threat Type: Backdoor

Platform: Windows

Confidence: High

Aliases and Related Activity:

• Delivered by HollowFrame via the embedded loader_panda.exe dropper (Matryoshka HTTP only)
• Matryoshka HTTP variant: version.dll sideloaded via OneDrive updater.exe
• Matryoshka GitHub variant: wtsapi32.dll: uses GitHub as a dead-drop C2 with per-victim directory mailboxes

Matryoshka is a previously undocumented Rust based backdoor family delivered as the final payload in an intrusion chain involving the HollowFrame framework. The family comprises two distinct variants, both of which abuse DLL sideloading to embed themselves inside trusted Windows processes.

Matryoshka HTTP is delivered as a malicious DLL that sideloads into Microsoft’s OneDrive. It proxies the Windows Version API to preserve host functionality while a worker thread decodes an XOR encrypted C2 configuration and establishes plaintext HTTP command and control. The implant supports victim registration, sequenced shell command execution via cmd.exe, and JSON formatted result reporting.

Matryoshka GitHub is delivered as a malicious DLL that proxies 41 Windows Terminal Services API exports. It communicates exclusively through the GitHub Contents API, using a private repository as a dead-drop for per-victim tasking, reconnaissance, file transfer, and secondary payload delivery. Each victim receives a dedicated repository directory containing beacon.json, cmd.json, and result.json files. The implant masquerades as a OneDrive client.

Matryoshka activity maps to the following MITRE ATT&CK techniques observed by the Blackpoint Adversary Pursuit Group (APG).

Blackpoint APG observed Matryoshka alongside the following tooling, related families, and legitimate software abused during the intrusion chain.

Organizations investigating potential Matryoshka activity should review the following indicators identified by Blackpoint APG.

• Hunt for Matryoshka GitHub activity by correlating unexpected api.github[.]com connections from non-browser processes with requests to /repos/adioziaete/memio/contents/ or the OneDrive/24.170.0825.0001 user-agent in proxy logs.
• Alert on signed trusted binaries (updater.exe, OneDrive components, Terminal Services clients) that load DLLs (version.dll, wtsapi32.dll) from non-system directories. Verify the DLL load path matches the expected Windows system directory.
• Monitor for cmd.exe or PowerShell spawned by OneDrive updater processes, Python hosts, or applications that loaded non-system copies of version.dll or wtsapi32.dll. Flag command lines containing 2>&1 output redirection or chcp 65001 patterns from unusual parent processes.
• Constrain GitHub API access from non-development endpoints using proxy policy or application-aware controls. Limit api.github[.]com connections to known developer systems while avoiding broad blocking that would disrupt legitimate GitHub usage.
• Build detection rules for WTS and Version API proxy DLLs: flag version.dll or wtsapi32.dll loaded from non-system32 paths, and correlate with outbound HTTP or GitHub API traffic from the same process.
• Where Matryoshka GitHub infrastructure is confirmed active, consider engaging GitHub Trust & Safety to request removal of the adioziaete/memio repository, which removes the operator’s ability to deliver new tasking to active implants.

For a deeper analysis of Matryoshka, read Blackpoint Cybers Nested Trust: HollowFrame’s Layered Loader and Matryoshka Backdoors.