New Go Loader HollowFrame Deploys Rust Backdoor in Law Firm Phishing

Researchers at Blackpoint Cyber discovered a new Go-based loader framework called HollowFrame and a Rust-based malware family named Matryoshka. The attack starts with a spear-phishing email containing a link to an encrypted archive with a Windows Shortcut. Executing the shortcut triggers a multi-stage chain that ultimately deploys the backdoor.