Security researchers have uncovered a complex, multi-stage intrusion targeting a law firm, utilizing a new Go-based loader called HollowFrame to deploy a Rust-based backdoor named Matryoshka. The attack begins with a spear-phishing email disguised as "Case Documents," tricking victims into executing a malicious Windows Shortcut that triggers a chain of privilege escalation and defense evasion tactics. HollowFrame exploits a DLL side-loading technique using a legitimate Python binary to hide its malicious activities, while Matryoshka establishes a persistent foothold with two distinct variants: one communicating over standard HTTP and another using a private GitHub repository as its command-and-control server. This separation of duties ensures that no single component contains the full infection logic, significantly complicating detection and attribution efforts for cybersecurity defenders.