Researchers reported a real spear‑phishing intrusion against a law firm where attackers sent a message with a link to an encrypted archive. The archive contained a Windows shortcut (LNK) disguised as “Case Documents,” and running it launched a multi‑stage loader (“HollowFrame”) that ultimately installed the Matryoshka backdoor for remote control and follow-on malware delivery.
This intrusion targeted a law firm and began with a spear-phishing message containing a link to an encrypted archive. Inside that archive was a Windows Shortcut (LNK) file disguised with the filename Case Documents, a lure designed to look like something an attorney or paralegal would expect to receive and open without hesitation.
When the recipient ran the LNK file, it activated a command sequence that used PowerShell to fetch next-stage components from a remote server. This led to a multi-stage loader known as HollowFrame, which used DLL side-loading with a legitimate Python binary and a rogue DLL to avoid detection. The final payload was the Matryoshka backdoor, which came in two variants: one using HTTP-based command-and-control and another using a private GitHub repository to poll for commands, submit results, and fetch payloads. Persistence was established through a scheduled task, and the chain included steps aimed at weakening Microsoft Defender protections.
The lure worked because it relied on a context legal staff regularly encounter, namely receiving case-related documents from external parties. An encrypted archive delivered via a link added a layer of legitimacy and also helped the payload evade automated scanning. The LNK file's document-style name masked the fact that it was an executable shortcut rather than an actual file, which made it easy to overlook as a red flag.
Legal teams and administrative staff who regularly exchange case files with outside parties are natural targets for this kind of pretext. Awareness building should focus on treating encrypted archive links as inherently higher risk, never executing LNK files received as documents regardless of filename, and reporting any command-line or PowerShell activity that follows opening a file. Security teams should also reinforce that a legitimate-looking destination, such as a well-known code hosting platform, does not guarantee safe traffic, since attackers can repurpose trusted infrastructure for command-and-control. Combining this awareness with technical controls, such as restricting LNK execution from archives and monitoring for scheduled task creation, can reduce the chances of this type of intrusion succeeding.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It began with a spear-phishing message containing a link to an encrypted archive, which held a Windows Shortcut (LNK) disguised as Case Documents.
Running the LNK triggered a command sequence using PowerShell to fetch additional components from a remote server, eventually leading to a multi-stage loader and the Matryoshka backdoor.
One variant of the Matryoshka backdoor used a private GitHub repository to poll for victim-specific commands, submit results, and fetch payloads, showing that trusted platforms can still be abused for command-and-control.
Treat unexpected encrypted archive download links as high risk, avoid running LNK files labeled as documents, and report unexpected PowerShell or command activity after opening a file.
At a real law firm, everything started with one email: a link to an encrypted archive called “Case Documents.” They click, download the zip, open it, and inside is a single file: a Windows shortcut named “Case Documents.lnk,” not a Word or PDF. Double-clicking that shortcut silently kicks off PowerShell, pulls more code from 2.26.252.84, side-loads a fake python311.dll, and drops the Matryoshka backdoor that even talks to a private GitHub repo adioziaete/memio. Your move: if a link gives you an encrypted archive and the only “document” inside is a .lnk shortcut, stop and forward it to Security, do not open it.
Researchers say a law firm was targeted with a spear‑phishing email that led staff to download an encrypted archive containing a Windows shortcut labeled like legal case files. After the user ran it and approved admin rights, the malware told Microsoft Defender to ignore a folder and a fake…
A Japanese industrial manufacturer was targeted by the SilverFox group using an invoice-themed phishing email that kicked off a multi-stage malware chain. The campaign abused legitimate software and cloud services to load a malicious DLL, disable security tools, and establish remote access with…
AhnLab reports Larva-24009 has continued phishing campaigns through 2026, sending emails that trick employees into opening fake “document” attachments that are actually shortcut (LNK) files. When opened, the attachment runs hidden PowerShell commands, shows a decoy document, and silently downloads…
Microsoft observed real-world campaigns where victims were tricked by “ClickFix” prompts into pasting a command into Windows Run, which then installed ACR (Amatera) Stealer. The malware steals saved browser passwords, live session tokens, and Microsoft 365/OneDrive/SharePoint files, meaning…
Researchers reported a real phishing campaign (“Operation BlueDash”) that tricks users with a “secure document” lure and routes them to a fake Microsoft Store page that claims Microsoft Teams must be updated. The download installs legitimate remote access tools (Level RMM and ScreenConnect) so…
Cybercriminals sent emails styled like Bank of America that redirected victims to fake pages and pushed a download called “Account Guard.” On Windows, the download installed ScreenConnect remote management software, giving attackers remote control of the device. The campaign used lookalike domains…
