UAC-0099 sharpens MATCHBOIL downloader in Ukraine espionage campaign
ESET Research has published a detailed analysis of MATCHBOIL, a custom C# downloader attributed to UAC-0099, a cyberespionage group the Slovak cybersecurity vendor assesses with medium confidence to be aligned with Russian interests. The malware has been evolving continuously since at least April 2024, with the most recent samples dated April 2026, each iteration adding capability and evasion sophistication.
According to ESET, victims observed in the company's telemetry have been exclusively in Ukraine, spanning transportation, manufacturing and energy. From July to August 2025, ESET detected MATCHBOIL samples at multiple Ukrainian transportation companies. A manufacturing company was affected in December 2025, and an energy-sector organisation was identified in June 2026.
How MATCHBOIL works
The malware is delivered via spear phishing emails containing malicious links. Clicking the link retrieves an archive that drops a VBScript file, which in turn downloads and executes MATCHBOIL on the target machine. Fernando Tavella, the ESET researcher who led the analysis, described the evolution of the tool: "MATCHBOIL has evolved from a one-shot downloader to a downloader that can communicate with the C&C server every two minutes; in late 2025, UAC-0099 added a graphical user interface that appears if the user executes the payload. It changed to a less-conspicuous version in early 2026."
UAC-0099 operators host their command-and-control infrastructure on virtual private servers, including those from BitLaunch, and use Cloudflare's services to mask the underlying server addresses. Both HTTP and HTTPS are used for C&C communications. Across the two-year sample window, ESET documented a shift to the .NET Reactor obfuscator, a deliberate move to hinder detection by endpoint security tools. The group's willingness to iterate quickly on evasion technique points to a well-resourced and operationally disciplined threat actor.
Although CERT-UA first publicly documented MATCHBOIL in August 2025, ESET's analysis of compilation timestamps places the earliest samples in April 2024, indicating the group had been quietly developing and deploying the tool for more than a year before it entered public reporting.
Threat landscape and wider context
UAC-0099 sits within a broader cluster of Russia-aligned advanced persistent threat groups targeting Ukrainian critical infrastructure. ESET notes that the group may function as an initial access broker for Sandworm, a more widely documented destructive threat actor responsible for attacks on Ukrainian power grid infrastructure and other critical systems. If that relationship is confirmed, MATCHBOIL infections could serve as precursors to more disruptive follow-on operations rather than purely espionage-oriented intrusions.
The campaign underlines a persistent pattern in cyber operations around the Russia-Ukraine conflict: targeted, sector-aware espionage against industrial and governmental entities, using commodity hosting infrastructure layered behind obfuscation services to complicate attribution and takedown. For defenders, the use of Cloudflare as a C&C proxy is a known technique that can frustrate network-level blocking, and the shift to .NET Reactor obfuscation means static-signature detection is of limited value without behavioural analysis.
Organisations in Ukrainian critical infrastructure sectors, and those with supply chain exposure to Ukrainian counterparts, should treat spear phishing with archive attachments containing scripting files as a high-priority threat vector. The EU's NIS2 Directive, which came into force across member states at the end of 2024, requires operators of essential services to maintain incident-response capability and report significant incidents within 24 hours; a MATCHBOIL compromise would qualify. UK organisations subject to the Network and Information Systems Regulations face similar obligations.
ESET's full technical breakdown, including indicators of compromise, is available on its WeLiveSecurity blog.