An investigation at a Russian industrial enterprise found a previously unseen modular backdoor, MataDoor, running with filenames chosen to mimic legitimate software and, in some cases, valid Sectigo signatures and Themida packing. The suspected initial access was a phishing DOCX tailored to defense-industry targets that exploited CVE-2021-40444 after the user enabled editing, with similar HTML-encoded payload URLs also seen in 2021 attacks against Russian defense organizations. MataDoor uses a loader service for persistence, encrypted configuration, an orchestrator-and-plugin architecture, and C2-driven functional and transport modules for long-term covert access. Kaspersky had associated the related MATAv5 backdoor with Lazarus activity, but the authors of this investigation state they could not definitively identify the tool’s operator and track the campaign as Dark River.