UAC-0099 (Organization): news timeline & CVEs

Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift

Cyber-espionage actor UAC-0099 has upgraded its MatchBoil dropper with stealthier capabilities for ongoing campaigns against Ukrainian organizations.

UAC-0099, a cyber-espionage actor described as Russian-linked, continues to operate campaigns against Ukrainian organizations. The group has steadily refined its flagship MatchBoil dropper, giving the malware a stealthier profile to better evade detection. Defenders should review and update detections for the new MatchBoil variant.

Dark ReadingOct 8, 18:01 UTC · 6h agoThreat actor in the wild 4 sources

Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware

ESET documents two years of UAC-0099 upgrades to its MATCHBOIL downloader used in espionage against Ukrainian government, energy and transport sectors.

ESET research published October 8 details how UAC-0099, assessed with medium confidence as Russia-aligned, steadily upgraded its MATCHBOIL C# downloader across versions observed from April 2024 to April 2026. Later samples adopted the Eziriz .NET Reactor obfuscator, sandbox-evasion checks, a two-minute C2 polling timer, and decoy GUIs such as a daily planner. Persistence shifted between Windows Registry Run keys and scheduled tasks. Victims include Ukrainian transportation, manufacturing and energy organizations, with activity observed as recently as June 2026.

Infosecurity Magazineupdated Oct 8, 18:01 UTC · 6h agofirst Oct 8, 13:00 UTC · 11h agoThreat actor in the wild 4 sources1

UAC-0099

Timeline2 articles

Appears with

Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift

Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware