“Case Documents” Lure Hits Law Firm via LNK

How the Attack Worked

This intrusion targeted a law firm and began with a spear-phishing message containing a link to an encrypted archive. Inside that archive was a Windows Shortcut (LNK) file disguised with the filename Case Documents, a lure designed to look like something an attorney or paralegal would expect to receive and open without hesitation.

When the recipient ran the LNK file, it activated a command sequence that used PowerShell to fetch next-stage components from a remote server. This led to a multi-stage loader known as HollowFrame, which used DLL side-loading with a legitimate Python binary and a rogue DLL to avoid detection. The final payload was the Matryoshka backdoor, which came in two variants: one using HTTP-based command-and-control and another using a private GitHub repository to poll for commands, submit results, and fetch payloads. Persistence was established through a scheduled task, and the chain included steps aimed at weakening Microsoft Defender protections.

Why It Succeeded

The lure worked because it relied on a context legal staff regularly encounter, namely receiving case-related documents from external parties. An encrypted archive delivered via a link added a layer of legitimacy and also helped the payload evade automated scanning. The LNK file's document-style name masked the fact that it was an executable shortcut rather than an actual file, which made it easy to overlook as a red flag.

What to Watch For

• Unexpected encrypted archive links, especially when no file was anticipated
• A downloaded file that turns out to be a Windows Shortcut (.LNK) rather than a real document
• Filenames like Case Documents used specifically to prompt a click
• Unexpected PowerShell or command-line activity immediately after opening a file
• Use of trusted platforms like GitHub for command-and-control traffic, which can make malicious activity look benign

How to Build Resistance

Legal teams and administrative staff who regularly exchange case files with outside parties are natural targets for this kind of pretext. Awareness building should focus on treating encrypted archive links as inherently higher risk, never executing LNK files received as documents regardless of filename, and reporting any command-line or PowerShell activity that follows opening a file. Security teams should also reinforce that a legitimate-looking destination, such as a well-known code hosting platform, does not guarantee safe traffic, since attackers can repurpose trusted infrastructure for command-and-control. Combining this awareness with technical controls, such as restricting LNK execution from archives and monitoring for scheduled task creation, can reduce the chances of this type of intrusion succeeding.

How did the attack against the law firm start?

It began with a spear-phishing message containing a link to an encrypted archive, which held a Windows Shortcut (LNK) disguised as Case Documents.

What happened after the LNK file was opened?

Running the LNK triggered a command sequence using PowerShell to fetch additional components from a remote server, eventually leading to a multi-stage loader and the Matryoshka backdoor.

Why is a GitHub repository mentioned in this attack?

One variant of the Matryoshka backdoor used a private GitHub repository to poll for victim-specific commands, submit results, and fetch payloads, showing that trusted platforms can still be abused for command-and-control.

What should legal staff watch for based on this attack?

Treat unexpected encrypted archive download links as high risk, avoid running LNK files labeled as documents, and report unexpected PowerShell or command activity after opening a file.