Blackpoint Cyber tracked a multi-stage intrusion that hit two endpoints at a law firm, starting with a spear-phishing message that linked to an encrypted archive containing a Windows Shortcut (LNK) file named to look like "Case Documents." One click launched a PowerShell command sequence that pulled next-stage components from a remote server at 2.26.252[.]84. (Source: The Hacker News)

Law firms hold material that is valuable to more than one kind of buyer: privileged client communications, merger and litigation strategy, patent filings, and financial records belonging to other companies.

The intrusion chain deployed two previously undocumented tools. HollowFrame is a Go-based modular loader that establishes persistence through a scheduled task and checks for sandbox conditions — system uptime, installed memory, file count in the user profile, and cursor movement — before it runs. It loads via DLL side-loading, pairing the legitimate Python binary python.exe with a rogue python311.dll.

That loader unpacks an encrypted container to start a second side-loading chain and drop Matryoshka, a Rust-based backdoor. One variant (version.dll) talks to a C2 server at 45.158.196[.]184:8888 over HTTP to spawn a shell. A second variant (wtsapi32.dll) uses a private GitHub repository instead of a dedicated server.

"Together, HollowFrame and Matryoshka gave the actor a persistent foothold for remote command execution, Active Directory reconnaissance, file transfer, and deployment of follow-on tooling," wrote researchers Nevan Beal and Sam Decker.

Active Directory reconnaissance is the step that turns one infected workstation into a path toward your document management system and mailboxes. The sections that follow break down the full execution chain stage by stage, including the privilege escalation and Microsoft Defender weakening that preceded payload delivery, then cover the indicators and response actions that apply to your environment.

Attack Chain: From Spear-Phishing Email to Backdoor Installation

After the initial command sequence runs, the chain moves to privilege escalation and then weakens Microsoft Defender protections before pulling further payloads. That ordering matters for forensics: by the time the loader itself lands on disk, endpoint protection has already been degraded, so the absence of AV alerts is not evidence that nothing executed.

HollowFrame, a Go-based modular loader, is launched through a DLL side-loading pair: the legitimate Python interpreter python.exe paired with a rogue python311.dll. Side-loading (T1574.002) means the malicious code executes inside a signed, expected process, so parent-child relationships look ordinary in process telemetry.

Before it does anything useful to the operator, HollowFrame runs anti-analysis checks to decide whether it is sitting in a sandbox. Blackpoint Cyber documented four signals it evaluates:

• System uptime
• Installed physical memory
• File count in the user profile directory
• Cursor movement

These checks map to T1497 (Virtualization/Sandbox Evasion). Practically, a detonation in an automated analysis appliance with a fresh profile, low RAM, and no mouse input produces a clean verdict, which is why the sample can pass through file-detonation controls and still fully execute on a real workstation.

Persistence comes from a scheduled task (T1053.005) rather than a Run key, which keeps it out of the registry autorun locations that many triage scripts check first. The loader survives reboot and continues to reach out for auxiliary components.

HollowFrame ships with an embedded encrypted container. Unpacking it kicks off a second side-loading chain that drops Matryoshka, a Rust-based backdoor delivered as version.dll. Two distinct DLL side-loading events in the same intrusion, hours or stages apart, are the structural signature of this chain.

The HTTP variant of Matryoshka talks to 45.158.196[.]184:8888, spawns a shell, and delivers additional tooling — T1071.001 for the web protocol channel and T1105 for ingress tool transfer. Interactive shell access on an endpoint gives an operator the same reach a logged-in administrator has, without needing to break anything further.

The second variant, recovered as wtsapi32.dll, drops the dedicated C2 server entirely and uses a private GitHub repository (adioziaete/memio) as its channel — T1102, Web Service. Each infected host is assigned its own <computer>_<username> directory functioning as a mailbox, containing:

• beacon.json — check-in data
• cmd.json — operator tasking
• result.json — command output returned to the operator
• an upload/ tree in some cases, used for file delivery

Because tasking rides over normal HTTPS traffic to github.com, this variant blends into developer traffic that most environments already permit. If your network allows GitHub API access broadly, egress filtering will not separate this beacon from legitimate use.

Together the two components supported remote command execution, Active Directory reconnaissance (T1087.002, T1482), file transfer, and delivery of follow-on tooling — the groundwork for credential theft and lateral movement into a wider domain compromise.

"Across the chain, each stage reduced the amount of malicious behavior visible in the stage before it," Blackpoint noted. "That separation complicated attribution and detection because no single component contained the full infection logic or complete C2 picture."

Key indicators for hunting and forensics: the loader IP 2.26.252[.]84, the Matryoshka C2 at 45.158.196[.]184:8888, side-loaded DLL names python311.dll, version.dll, and wtsapi32.dll, and the GitHub account adioziaete, created January 6, 2023 with profile information updated as recently as June 7, 2026. Attribution remains unknown.

Business and Regulatory Exposure for Legal Services Firms

The GitHub-based variant of Matryoshka gave each compromised machine its own directory in a private repository, named <computer>_<username> and holding beacon.json, cmd.json, result.json, and in some cases an upload/ tree. Tasking and results moved over HTTPS to a platform your developers and IT staff already use every day.

That matters for your breach scoping more than for your firewall. When exfiltration and command traffic blend into normal traffic to a major code-hosting service, you may be unable to state with confidence which matter files left the building — and Blackpoint noted the operator can remove the commits or the repository, taking the versioned history of tasking with them.

Under most state breach-notification statutes and outside counsel guidelines, uncertainty is expensive. If you cannot prove what was taken, you notify broadly, which turns a two-endpoint intrusion into a firm-wide client communication.

The second consequence is scope creep inside your own domain. Blackpoint reported that the pair supported Active Directory reconnaissance, remote command execution, file transfer, and delivery of follow-on tooling — capabilities the researchers said could support credential theft, lateral movement, and broader domain compromise. In a legal environment, domain-level access reaches the document management system, the email archive, the conflicts database, and the accounting platform that touches client trust funds.

Your professional-conduct obligations attach at that point regardless of what the attacker actually read. State bar rules on confidentiality and client communication generally require you to tell affected clients that their privileged material may have been accessed, and that disclosure is not something you control the timing of.

• Privilege and litigation strategy: exposed work product in an active matter can affect settlement posture, and opposing parties may probe the incident in discovery.
• Client-flowed regulation: if you hold health, financial, or EU personal data on behalf of corporate clients, their HIPAA, GLBA, and GDPR obligations reach you as a service provider — GDPR penalties are calculated against a share of global annual turnover, and your client's regulator will ask what your controls looked like.
• Contractual triggers: outside counsel guidelines commonly set short notification windows and give clients audit rights or the right to move work elsewhere.
• Malpractice exposure: claims alleging inadequate safeguarding of confidential material follow the notification, not the intrusion.

Law firms are attractive targets for a reason that has little to do with the size of your file share. You aggregate the sensitive material of many organizations under one roof, with fewer security staff than any of those clients, and your people open unfamiliar attachments from unfamiliar parties as a core job function.

The extortion angle follows from the architecture rather than from anything observed here. Because the framework's job is to deliver whatever tooling the operator chooses next, the actor decides the endgame after establishing access — data theft for resale, quiet long-term collection, or encryption — and your exposure is set by how long the foothold went unnoticed, not by which option they picked.

The account behind the repository was created on January 6, 2023, with profile information updated as recently as June 7, 2026, and attribution remains unknown. For your partners, that means there is no named group to point to when a client asks who had their file.

Detection and Immediate Response for Law Firm Security Teams

Start by hunting for outbound connections to 45.158.196[.]184 on TCP port 8888 across every endpoint, not just the two known to be affected. That address is the HTTP command-and-control server for the Matryoshka backdoor, and a hit in your proxy or firewall logs identifies a compromised host faster than any file-based search.

First 24 hours

• Isolate matching hosts at the network level, but leave them powered on. Capturing memory and a full disk image preserves the loader's decrypted container and any staged tooling that a reimage would erase.
• Search for version.dll and wtsapi32.dll written into directories alongside legitimate signed executables. Both are Matryoshka payloads delivered through side-loading, and their presence outside a system directory is the clearest on-disk indicator.
• Audit scheduled tasks created or modified in the intrusion window. HollowFrame establishes persistence through a scheduled task, so a task with an unfamiliar name pointing at a user-writable path is your persistence artifact.
• Pull Microsoft Defender configuration history on every suspect host: added exclusions, disabled real-time protection, and tamper protection state. The chain weakens Defender before the loader lands, so a clean scan today tells you nothing about what ran yesterday.
• Engage incident response and outside counsel in the same call. Routing the investigation through counsel preserves privilege over the findings, which matters when the affected data belongs to your clients rather than your firm.

In environments Capstone manages, SentinelOne flags the Defender tampering and the signed-binary side-loading pair described above and blocks execution before the second-stage container unpacks, which is the point in this chain where you still have a single-host problem rather than a domain-wide one.

Days one through seven

Scope the Active Directory reconnaissance. The operators used this foothold to enumerate the domain, so review domain controller logs for bulk LDAP queries, group membership reads, and unusual net or PowerShell AD module activity originating from the affected endpoints.

Assume any credential cached on those machines is compromised and rotate it, including service accounts and any document management system credentials the users held. Forced password resets alone do not evict an attacker who already holds a session token, so invalidate active sessions as well.

Verify your backups predate the earliest confirmed execution and restore a sample matter file to prove the copies are readable. Then map which client matters those two users could reach, since that list — not the endpoint count — determines your notification obligations under bar rules and state breach statutes.

Structural changes

• Enforce DMARC at p=reject with aligned SPF and DKIM, then configure your mail gateway to quarantine password-protected archives that cannot be scanned. The initial lure relied on an encrypted archive precisely because the contents stay opaque to inspection.
• Block or sandbox LNK files delivered through email and web downloads, and apply application control so the Python interpreter cannot execute from user profile or temp directories.
• Apply egress filtering so workstations reach external hosts only through an inspecting proxy. Direct outbound connections to a raw IP on a nonstandard port should fail by default and generate an alert.
• Segment your document management and matter file stores behind separate authentication, so a compromised paralegal workstation does not translate into access to every open case.
• Run phishing simulations using litigation-themed lures — case documents, court notices, discovery requests — because those are the pretexts your staff are conditioned to open without hesitation.

If your telemetry retention is shorter than 90 days, extend it now; the GitHub account tied to this activity has been active since January 2023, and short log windows will not answer when your firm was first touched.

Hardening Email and Endpoint Defenses Against HollowFrame Variants

The highest-return control here is your mail gateway's handling of encrypted archives. Password-protected containers cannot be scanned or detonated, so configure your gateway to quarantine them for review rather than deliver them, and require that legitimate senders of protected files use your client portal instead. Most law firms exchange sensitive documents through a document management or secure file-share platform already, which makes this a policy change rather than a workflow rewrite.

Pair that with a rule that strips or quarantines Windows Shortcut files, script files, and container formats arriving from external senders. LNK delivery works because the file looks like a document to the recipient and executes like a script to the operating system.

Your sandbox configuration deserves a second look. HollowFrame checks system uptime, installed memory, the number of files in the user profile, and cursor movement before it runs, so a freshly built, idle analysis VM returns a clean verdict on a file that would detonate on a paralegal's laptop. Ask your email security provider how their detonation environments simulate user activity and aged profiles — if the answer is vague, treat sandbox verdicts as one signal rather than proof.

On the endpoint, application control gives law firms an advantage that larger enterprises rarely have: a small, stable application inventory. Practice management, document management, e-discovery, Office, a browser, and a PDF tool cover most of the job. That makes WDAC or AppLocker in enforcement mode genuinely achievable:

• Allow execution only from C:\Program Files and C:\Windows, blocking binaries and DLLs launched from user-writable paths like %APPDATA%, %TEMP%, and the Downloads folder.
• Enable the Microsoft ASR rules that block executable content launched from email clients and webmail, and block scripts from launching downloaded executables.
• Turn on Tamper Protection and require a separate administrative credential to modify endpoint protection settings, so a script running as the logged-on user cannot reduce them.
• Restrict interpreters your firm does not use for business — Python, wscript, and cscript — through the same policy, since side-loading needs a signed host process to be allowed to run in the first place.

Enforce MFA on every remote entry point, not just VPN: webmail, the document management portal, e-discovery platforms, and any remote desktop gateway. Adlumin ITDR monitors authentication patterns across managed environments, flagging impossible-travel logins, new MFA device registrations, and session anomalies that indicate an operator using credentials harvested after initial access rather than exploiting anything.

Segment your matter repositories so a single compromised workstation cannot enumerate every client's files. Attorneys and staff should reach document stores through the application layer with per-matter permissions, not through open SMB shares mapped to broad groups. Restrict outbound access to code-hosting and developer platforms to the IT and development groups that actually need it, and log the rest.

For recovery, keep offline or immutable copies of matter files and email archives, and test a restore of a full practice group's data at least twice a year so you know the recovery time before you need it.

If budget forces a choice, start with gateway handling of encrypted archives and application allowlisting on attorney and staff endpoints. Those two controls break this chain at the delivery stage and at the execution stage.

Next Steps: Breach Notification, Investigation, and Client Communication

The intrusion Blackpoint Cyber documented gave an unidentified operator remote command execution, Active Directory reconnaissance, file transfer, and a delivery channel for follow-on tooling inside a law firm. Attribution remains open — the GitHub account used for tasking was created on January 6, 2023, with profile information updated as recently as June 7, 2026, and no researcher has tied it to a named group.

That uncertainty shapes what you do next. When you cannot name the actor, you cannot assume their objective was limited to one matter or one client, so scoping has to be driven by evidence rather than by an assumption about intent.

The most important action is to bring in outside forensic investigators and your firm's counsel at the same time, not sequentially. Your technical team determines which endpoints executed the loader and what left the network; your counsel translates those findings into duties under state breach notification statutes, professional conduct rules on client confidentiality, and any outside counsel guidelines your corporate clients impose contractually.

Running those tracks in parallel matters because your notification clock and your investigation timeline rarely align. Clients often learn about an incident through a regulator or a counterparty before their own firm calls them, which is a harder conversation than an early, incomplete update.

Assume a spear-phishing message will eventually get a click, and build your detection and response around shortening dwell time and knowing precisely which client files were reachable.