MataDoor is a complex modular backdoor designed for long-term covert operation on compromised computers. It was discovered during an October 2022 investigation at a Russian industrial enterprise. Samples used executable names resembling legitimate installed software, some carried valid digital signatures, and executables and libraries were protected with Themida to impede detection and analysis. Investigators assessed the initial vector as a phishing email carrying a DOCX attachment tailored to the enterprise's field and presented as an HR request. Enabling editing triggered exploitation of CVE-2021-40444 and execution of malicious content, with payload URLs HTML-encoded.