ESET says UAC-0099 has reworked its MatchBoil downloader since at least July 2024, with the newest version appearing in April 2026. Repeated changes aimed at security software mean indicators from CERT-UA's August 2025 write-up describe an older build.
Perspective Coverage
4 publishers
- Builder
- Builder 30%
- Operator
- Operator 63%
- Investor
- Investor 7%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+12
- Incentives35
- Confidence66
UAC-0099, a Russia-aligned group, has pushed its MATCHBOIL downloader from Ukrainian transport firms into a manufacturer and an energy company, ESET says. The researchers tracked the tool for almost two years; it installs MATCHWOK, a C# backdoor that grabs screenshots and runs PowerShell.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence66
Invisible HTML elements carry the commands for UAC-0099's ASHVEIN RAT
TrendAI has tied ASHVEIN, a previously undocumented .NET RAT, to UAC-0099 attacks on Ukrainian government personnel, citing five builds from October 2025. The group has fielded newer tools since, so detection that lasts has to target how it delivers and tasks its implants.
Reality
- Evidence50
- Adoption25
- Hype gap+10
- Incentives35
- Confidence50
CERT-UA says attackers planted fake Cloudflare checks on more than 100 legitimate websites to get visitors to install Lunex Stealer themselves. Ontinue says its browser components can keep file access after the stealer is deleted, so cleanup has to reach the browsers.
Perspective Coverage
3 publishers
- Builder
- Builder 30%
- Operator
- Operator 62%
- Investor
- Investor 8%
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap+10
- Incentives25
- Confidence70
Ukraine's cyber agency ties DarkSword iPhone attacks to hacked news and government sites
Ukraine's SSSCIP says Russian hackers are going after military and government phones, using hacked news and government sites to push the DarkSword iPhone kit. Because the kit needs little or no action from the victim, the defense falls on the phone's own software and how current it is.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence55
Cisco Talos found a 16.4MB Go implant that asks DeepSeek, Qwen, Mistral and Gemini what to do next and acts on the winning vote, treating the providers themselves as its C2 infrastructure. Talos has no confirmation it was ever deployed.
Perspective Coverage
7 publishers
- Builder
- Builder 28%
- Operator
- Operator 66%
- Investor
- Investor 6%
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+30
- Incentives45
- Confidence62
Access Now says helpline requests ran 30% to 40% above the usual post-notification surge, a record. Among the recipients: a Ukrainian soldier who assumed the alert was a scam.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+25
- Incentives35
- Confidence60
ESET found the bait comment in a loader for MATCHBOIL, malware it ties exclusively to the Russia-aligned group that feeds targets to Sandworm. The trick works because a model that refuses to read a file returns no verdict at all.
Reality
- Evidence55
- Adoption20
- Hype gap+25
- Incentives40
- Confidence60
Daybreak enters a Ukrainian defence that already runs Google's AI tools
OpenAI is giving Ukraine's government its Daybreak cyber defence system and GPT-5.6 Sol for nothing. The only figure published alongside the deal is CERT-UA's count of nearly 6,000 attacks in 2025.
Reality
- Evidence44
- Adoption30
- Hype gap+28
- Incentives72
- Confidence52
OpenAI gives Ukraine free Daybreak access to find weaknesses in hospital and grid systems
Daybreak identifies weaknesses in digital systems and helps develop fixes. CERT-UA counted nearly 6,000 attacks in 2025. The free access extends a pattern OpenAI already runs with European firms and UK banks.
Reality
- Evidence52
- Adoption28
- Hype gap+18
- Incentives74
- Confidence55
buildOne report1 publisher A tie in CLOSEDQUORUM's four-model vote hands the decision to DeepSeek
Cisco Talos released its CAIRN framework on September 22nd to hunt prompts, provider endpoints and API-key prefixes in malware metadata. Its first case study polls four commercial models and runs the winner.
Reality
- Evidence58
- Adoption18
- Hype gap+10
- Incentives60
- Confidence55
Cisco Talos's new malware tagger roughly tripled the public tally of AI-integrated samples
Cisco Talos has open-sourced CAIRN, a framework that tags malware by the traces its AI calls leave in metadata. The first sample it surfaced polls DeepSeek, Qwen, Mistral and Gemini for orders and decides for itself.
Reality
- Evidence55
- Adoption18
- Hype gap+26
- Incentives62
- Confidence58