.NET Reactor (Product): news timeline & CVEs

MATCHBOIL Malware Uses Cloudflare-Hidden C2 Servers to Deliver Backdoor Payloadsnew

UAC-0099's MATCHBOIL downloader hides C2 behind Cloudflare and delivers MATCHWOK to Ukrainian firms.

ESET documented MATCHBOIL, a C# downloader linked to UAC-0099, across samples from April 2024 to April 2026. Infections were recorded at Ukrainian transportation companies in July and August 2025, a manufacturer in December 2025, and an energy company in June 2026. Phishing links lead victims to run a VBScript that installs MATCHBOIL, which then retrieves MATCHWOK over HTTPS from servers hidden behind Cloudflare. Later versions use Eziriz .NET Reactor, debugger and uptime checks, two-minute C2 polling, and mail-themed scheduled tasks. ESET assesses alignment with Russian interests at medium confidence.

Cyber Security News10:10 UTC · 19m agoMalware in the wild 7 sources

What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor

Russia-aligned UAC-0099 uses MATCHBOIL to install the MATCHWOK spy backdoor on Ukrainian transport, manufacturing, and energy firms.

ESET says Russia-aligned group UAC-0099 has used the MATCHBOIL downloader for nearly two years to install MATCHWOK, a C# espionage backdoor, on Windows systems in Ukraine. Telemetry shows only Ukrainian victims: transportation companies in July and August 2025, a manufacturer in December 2025, and an energy company in June 2026. A spear-phishing link delivers a VBScript that launches MATCHBOIL, which fingerprints the host, retrieves a hex-encoded payload over HTTPS, and persists it with a scheduled task or registry key. MATCHWOK can take screenshots and run PowerShell; ESET says UAC-0099 has brokered initial access for Sandworm and assigns medium-confidence Russian alignment.

Help Net Securityupdated 10:10 UTC · 19m agofirst Oct 8, 09:00 UTC · 1d agoThreat actor in the wild 7 sources1

MATCHBOIL: New tricks, same old evil intentions

ESET details MATCHBOIL, a C# downloader UAC-0099 uses against Ukrainian transport, manufacturing, and energy firms.

ESET traced MATCHBOIL, a custom C# downloader used by Russia-aligned UAC-0099, from builds dated April 2024 through April 2026. Spearphishing links deliver an archive with a VBScript that the victim must run; MATCHBOIL then makes three HTTPS requests, extracts a hex-encoded payload—usually the MATCHWOK backdoor—and installs and persists it. Later versions added Eziriz .NET Reactor obfuscation and sandbox checks. Telemetry victims were all in Ukraine, including transportation firms in mid-2025, a manufacturer in December 2025, and an energy company in June 2026. UAC-0099 can also broker access for Sandworm and deploys the LONEPAGE PowerShell downloader.

ESET WeLiveSecurityupdated 10:10 UTC · 19m agofirst Oct 8, 08:45 UTC · 1d agoMalware in the wild 7 sources

.NET Reactor

Timeline3 articles

Appears with

MATCHBOIL Malware Uses Cloudflare-Hidden C2 Servers to Deliver Backdoor Payloadsnew

What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor

MATCHBOIL: New tricks, same old evil intentions