Russia-Aligned Hackers Use GuardBreaker Prompt Injection to Disrupt AI Malware Analysis
Russia-aligned group UAC-0099 embeds GuardBreaker prompt injection in a VBScript comment to make AI malware scanners refuse analysis of a MATCHBOIL loader.
ESET identified a UAC-0099 VBScript used in an early-stage intrusion against a target in Ukraine that hides a safety-triggering comment (a question about building a nuclear weapon) intended to make AI code scanners refuse to continue analysis. The script downloads MATCHBOIL, a loader associated exclusively with UAC-0099, alongside familiar anti-analysis checks for IDA and Wireshark. The technique turns the AI triage process itself into the attack target, risking missed detections or benign misclassification of malicious samples.
- GuardBreaker hides a safety-triggering question in a VBScript comment read by AI scanners
- Observed in an early-stage UAC-0099 intrusion against a target in Ukraine
- MATCHBOIL loader is associated exclusively with the UAC-0099 group
- ESET advises cross-checking AI triage results with static, behavioral, and human review
- Group also maintained familiar checks for IDA and Wireshark analysis tools
From the original article
3 min read at cybersecuritynews.com
Russia-aligned operators are testing a new way to make artificial intelligence overlook malicious code. The technique, called GuardBreaker, hides a safety-sensitive request inside an otherwise ordinary script comment, hoping that an AI code scanner refuses to continue its work. The activity was observed during an early-stage intrusion against a target in Ukraine.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.