Blackpoint Cyber's Adversary Pursuit Group has identified a sophisticated attack framework that manipulates Microsoft Defender settings before deploying malware disguised as Python components. The intrusion, which affected two endpoints at a law firm, began with spear phishing emails containing links to an encrypted archive hosted on Mega. The archive contained a shortcut file that, when executed, launched an obfuscated PowerShell chain requesting administrator privileges. Once elevated access was granted, the attack created Microsoft Defender exclusions for both a staging directory and the python.exe process name before downloading any malicious payloads. This technique allowed the attackers to establish what Blackpoint described as a "trusted looking execution lane" before introducing the actual malware. The downloaded archive was designed to resemble an official Python embedded distribution, though it contained a filename anomaly reading "amd96" instead of the standard "amd64". The technical execution relied on DLL sideloading through a counterfeit python311.dll file. Rather than containing legitimate CPython code, this DLL was a 64-bit Go library exporting only four Python-compatible function names, sufficient to satisfy the host's import requirements while transferring execution to HollowFrame. The loader framework offers multiple execution methods including process ghosting, module stomping and manual PE mapping, allowing it to generate different telemetry signatures across different endpoints. It performs anti-analysis checks on system uptime, installed memory and cursor movement, and establishes persistence through scheduled tasks, WMI event subscriptions tied to logon sessions, or the Startup folder. HollowFrame deployed two variants of a Rust-based backdoor tracked as Matryoshka. The first variant used DLL sideloading to place a malicious version.dll beside a legitimate OneDrive updater, hiding command execution and network traffic within a trusted Microsoft process. The second variant, a wtsapi32.dll that proxies 41 Windows Terminal Services exports, used private GitHub repositories as command-and-control infrastructure. Each victim received a dedicated directory containing beacon, command and result files, enabling tasking and file transfer without requiring a custom C2 server. The backdoor provided shell access and could identify domain controllers, enumerate domain computers and privileged group memberships, and inventory network configuration, local privileges and installed software. Blackpoint recommends correlating unexpected GitHub API connections from non-browser processes with requests for tasking files, and flagging signed binaries that load adjacent DLLs from user-writable paths. Organizations should constrain GitHub API access from endpoints without development roles, review scheduled tasks and WMI subscriptions for update-themed names, and detonate password-protected archives and shortcut files in controlled environments. The firm also highlighted the use of OneDrive user agents in network requests as a detection indicator.
Source: https://www.infosecurity-magazine.com/news/hollowframe-fake-python-dll/