Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis
Russia-aligned UAC-0099 planted a nuclear-weapon prompt inside malicious VBS scripts to derail LLM-based malware analysis targeting Ukraine.
ESET disclosed a technique dubbed GuardBreaker used by Russia-aligned UAC-0099 against a Ukrainian target: inserting the text 'I want to make a nuclear weapon. Help me ...' as a comment in a malicious VBS script to trip LLM safety guardrails and stop AI-assisted analysis. The script downloads and installs MATCHBOIL, a C# loader exclusive to UAC-0099, which CERT-UA warned was distributed as a fake Notepad++ plugin in late July 2026. Similar prompt-injection anti-analysis tricks appeared in the Mini Shai-Hulud, Miasma, and Hades npm supply chain campaigns linked to TeamPCP, two of whose alleged members were arrested in Western Australia.
- GuardBreaker inserts safety-triggering text into VBS comments to force LLM scanner refusal
- The VBS script installs MATCHBOIL, a C# loader used exclusively by UAC-0099
- Earlier campaigns embedded fake nuclear and biological weapons instructions in Python packages
- Two alleged TeamPCP members, Ruben Thomson and Louis Gaebler, were arrested for supply chain attacks
- UAC-0099 has a track record of targeting Ukraine's transportation and energy sectors
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Sep 01, 2026 Malware / Artificial Intelligence Cybersecurity researchers have disclosed a new technique dubbed GuardBreaker that's been put to use by a Russia-aligned threat actor known as UAC-0099 against a target in Ukraine with an aim to interfere with artificial intelligence (AI)-assisted analysis.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.