Russia-Aligned UAC-0099 Uses GuardBreaker Prompt Injection to Hide MATCHBOIL Malware From AI Scanners in Ukraine

ESET linked the GuardBreaker technique to Russia-aligned actor UAC-0099, which hid a guardrail-triggering comment (reportedly a question about building a nuclear weapon) in a VBScript so LLM-based malware scanners would refuse analysis of a MATCHBOIL loader…

ESET researchers have attributed a prompt-injection technique dubbed GuardBreaker to the Russia-aligned threat actor UAC-0099, observed in an early-stage intrusion against a target in Ukraine. The group embedded a safety-triggering comment in a VBScript — described by Cyber Security News as a question about building a nuclear weapon, and by GBHackers more generally as a safety-sensitive, weapon-related request — so that an LLM-powered analysis tool might interpret it as an instruction and refuse or truncate analysis before reaching the malicious code. The script downloads MATCHBOIL, a C#-based loader associated exclusively with UAC-0099 and used by the group alongside MATCHWOK and DRAGSTARE, and includes familiar anti-analysis checks for IDA and Wireshark. The technique turns the AI triage process itself into the attack target, risking missed detections or benign misclassification of malicious samples. Similar instruction-flooding tricks have been found in malicious PyPI and npm packages. OWASP guidance recommends treating code comments and metadata as untrusted input, sanitizing them, and never treating an LLM refusal as a clean verdict; ESET advises cross-checking AI triage results with static and behavioral analysis — signatures, sandboxes, EDR — and human review.

• ESET named and attributed the GuardBreaker technique (indirect prompt injection via comments to evade AI security scanners) to Russia-aligned actor UAC-0099; both reports published 2026-09-11.
• The malicious VBScript embedded a guardrail-triggering comment: Cyber Security News specifies a question about building a nuclear weapon, while GBHackers describes it as a safety-sensitive, weapon-related request.
• The goal was to make LLM-powered malware scanners refuse or truncate analysis before reaching the malicious code, risking missed detections or benign misclassification.
• Observed in an early-stage UAC-0099 intrusion against a target in Ukraine.
• The VBScript downloads MATCHBOIL, a C#-based loader associated exclusively with UAC-0099 and used alongside MATCHWOK and DRAGSTARE.
• The script also maintained anti-analysis checks for IDA and Wireshark.
• UAC-0099 has previously targeted Ukrainian government, defense, transportation, and energy sectors.
• Similar instruction-flooding tricks have been found in malicious PyPI and npm packages.