ESET says UAC-0099 has reworked its MatchBoil downloader since at least July 2024, with the newest version appearing in April 2026. Repeated changes aimed at security software mean indicators from CERT-UA's August 2025 write-up describe an older build.
Perspective Coverage
4 publishers
- Builder
- Builder 30%
- Operator
- Operator 63%
- Investor
- Investor 7%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+12
- Incentives35
- Confidence66
UAC-0099, a Russia-aligned group, has pushed its MATCHBOIL downloader from Ukrainian transport firms into a manufacturer and an energy company, ESET says. The researchers tracked the tool for almost two years; it installs MATCHWOK, a C# backdoor that grabs screenshots and runs PowerShell.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence66
Invisible HTML elements carry the commands for UAC-0099's ASHVEIN RAT
TrendAI has tied ASHVEIN, a previously undocumented .NET RAT, to UAC-0099 attacks on Ukrainian government personnel, citing five builds from October 2025. The group has fielded newer tools since, so detection that lasts has to target how it delivers and tasks its implants.
Reality
- Evidence50
- Adoption25
- Hype gap+10
- Incentives35
- Confidence50
ESET found the bait comment in a loader for MATCHBOIL, malware it ties exclusively to the Russia-aligned group that feeds targets to Sandworm. The trick works because a model that refuses to read a file returns no verdict at all.
Reality
- Evidence55
- Adoption20
- Hype gap+25
- Incentives40
- Confidence60
UAC-0099 hid a nuclear-weapons request in a VBScript comment to stall an LLM code scanner
ESET calls the technique GuardBreaker and notes that this bait, unlike most evasion tricks, is left in plain sight for the models reading the code to find.
Reality
- Evidence58
- Adoption32
- Hype gap+22
- Incentives68
- Confidence60