MatryoshkaMalware
Matryoshka is a malware framework used by CopyKittens that consists of a dropper, loader, and RAT. It has multiple versions; v1 was seen in the wild from July 2016 until January 2017. v2 has fewer commands and other minor differences.From MITRE ATT&CK
Last reported 27 days ago, by CERT-EU8 reports
ATT&CK techniques
6 of 11 · each with the sentence it comes from- T1053.005Scheduled Task
“It also checked uptime, installed memory and cursor movement before running and offered three persistence routes: a scheduled task, a WMI event subscription tied to new logon sessions and the Startup folder.”
- T1036Masquerading
“…elf-evident reasons: the use of Claude to host the malicious loader as a Claude Artifact, and the use of Claude Desktop itself as the masquerading application.”
- T1684Social Engineering
“…itimate directories, replacing them with malicious LNK shortcut files, and forge a second type of LNK shortcuts that use Ukrainian social engineering lures.”
- T1014Rootkit
“…able Roundcube servers to relay C2 traffic and also exploited CVE-2026-68820, a zero-day vulnerability in Windows to deploy a FudModule rootkit.”
- T1027.006HTML Smuggling
“Next, it initiates a HTML Smuggling technique with a Base64-encoded RAR archive embedded in its source code, named 2_14_6_1033_09.12.2025.rar and exploiting CVE-2025-8088.”
- T1027.009Embedded Payloads
“A decryption routine first handles the unpacking of embedded payloads by decoding Base64 strings and applying a second XOR operation using a hardcoded key.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
8 reports, newest first · the exact sentence from each-
Cyber Brief 26-09 - August 2026“In terms of digital foreign interference, pro-Russia Matryoshka and Storm-1516 targeted upcoming elections in Germany and France.”
-
Risky Bulletin: BEC campaign steals €35 million from French notaries“Matryoshka targets Germany: Just as one of its states was holding a major regional election, Russian disinfo group Matryoshka was busy pushing disinformation attacking all the German political parties except the far-right AfD and the far-left BSW.”
-
HollowFrame Loader Uses Fake Python DLL to Evade Defender“…oints at a law firm and deployed two undocumented families: a Go loader tracked as HollowFrame and a pair of Rust backdoors tracked as Matryoshka.”
-
Inside FakeAgent: How a Claude Desktop Malvertising Campaign Hit 29 Organizations with SectopRAT“…ntract, and the means to decrypt it; and we're given the live command-and-control (C2) address: 2.24.131.246, and we've surmounted the Matryoshka malware nesting present in this campaign.”
-
FSB’s matryoshka #3/3: Gamaredon's Gammasteel Infostealer“Discover part 3 of our FSB Matryoshka investigation.”
-
FSB’s matryoshka #2/3: Gamaredon's Gammaload Malware“In part 2 of our FSB Matryoshka series, we analyze Gamaredon's Gammaload malware variant, dissecting its technical updates and deployment mechanisms.”
-
FSB’s matryoshka #1/3: Inside Gamaredon Cyber Operations“Part 1 of our FSB Matryoshka series.”
-
The Cost of Understanding: LLM-Driven Reverse Engineering vs Iterative LLM Obfuscation“Obfuscator variant 1: Matryoshka Wall”
Indicators in its reports
named in the reports above- lesma[.]euin 2 reports
- check-host[.]netin 2 reports
- hxxps://bold.zsjtn41091.workers[.]devin 2 reports
- bold.zsjtn41091.workers[.]devin 2 reports
- collusion[.]wikiin 1 report
- mil.gov[.]uain 1 report
- teletype[.]inin 1 report
- write[.]asin 1 report
- tebi[.]ioin 1 report
- de-fra.i3storage[.]comin 1 report
- s3.tebi[.]ioin 1 report
- hxxps://justsstop[.]ru/in 1 report
- justsstop[.]ruin 1 report
- hxxps://165.22.170[.]129/in 1 report
- 165.22.170[.]129in 1 report
- norosta[.]ruin 1 report
- selltosell[.]ruin 1 report
- hxxps://rentry[.]co/hwzrmfkxin 1 report
- serveirc[.]comin 1 report
- webhop[.]mein 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.