Malware News HollowFrame Loader Uses Fake Python DLL to Evade Defender

[Khushal]

Content source

https://www.infosecurity-magazine.com/news/hollowframe-fake-python-dll/

A previously undocumented loader framework has been found disguising Go code inside a counterfeit Python runtime, after first instructing Microsoft Defender to ignore the directory and the process it was about to abuse.

According to new research from Blackpoint Cyber's Adversary Pursuit Group (APG), published on July 30, the intrusion hit two endpoints at a law firm and deployed two undocumented families: a Go loader tracked as HollowFrame and a pair of Rust backdoors tracked as Matryoshka.

HollowFrame Loader Uses Fake Python DLL to Evade Defender

New HollowFrame loader hid Go code in a fake Python DLL after pre-staging Defender exclusions

www.infosecurity-magazine.com

Exclusions Before Payloads​

The chain began with a spear phishing email sent to several staff. A link routed recipients through an attacker-controlled redirector to an encrypted archive hosted on Mega, containing a shortcut file named Case Documents.lnk.

Executing it wrote Base64 content to a temporary file, rebuilt a script using the built-in certutil utility, then launched an obfuscated PowerShell chain that prompted the user for administrator rights.

Once elevated, that stage created Defender exclusions covering both a staging directory and the process name python.exe, and only then began downloading executable content. Blackpoint said the actor had "effectively prepared a trusted looking execution lane" before the loader arrived.

The archive it retrieved was named to resemble an official Python embedded distribution, though the filename read amd96 rather than amd64.

 

[Bot]

Defensive Takeaways

This is a notable example of defense evasion being performed before the main payload was delivered. The most important indicators are not necessarily the fake Python runtime itself, but the sequence of actions:

• A spear-phishing link leading through an attacker-controlled redirector
• An archive hosted on Mega containing a malicious .lnk file
• Use of certutil to reconstruct or decode content
• Obfuscated PowerShell execution
• A privilege-elevation prompt
• Creation of Microsoft Defender exclusions for a staging directory and python.exe
• Execution of an apparently legitimate-looking embedded Python distribution

A Defender exclusion for a commonly used interpreter such as python.exe is particularly concerning because it can create a broad execution blind spot. The exclusion should be treated as a security event, not as routine configuration, especially when it appears shortly before downloads or process launches.

Recommended Checks

On affected systems, defenders should preserve evidence before removing artifacts where possible, then review:

• Microsoft Defender operational logs for exclusion additions, including the account and process that created them
• PowerShell and process-creation logs for certutil.exe, powershell.exe, cmd.exe, and the downloaded runtime
• Shortcut metadata, including the target, arguments, working directory, and creation timestamps of Case Documents.lnk or similarly named files
• Recent downloads, browser history, redirector activity, and Mega access
• The Defender exclusion paths and process names currently configured
• Scheduled tasks, Run keys, services, startup folders, and other persistence locations
• Outbound connections made by the suspected Python, Go, or Rust-related processes

The reported filename mismatch, such as amd96 instead of amd64, may be a useful clue, but filenames alone are not reliable indicators. Files should be identified by cryptographic hash and analyzed through reputable endpoint tooling or a trusted malware-analysis service such as VirusTotal, while considering that public submissions may disclose sensitive samples.

If unauthorized exclusions or execution are confirmed, isolate the endpoints, remove the exclusions only after collecting relevant evidence, rotate credentials that were used on those systems, and investigate whether the same phishing message reached other users.

The broader lesson is that legitimate tools such as certutil, PowerShell, Python, and cloud storage can be abused in combination. Detection should therefore focus on the full execution chain and unusual configuration changes rather than on any one tool in isolation.