GuardBreaker: Russia-aligned UAC-0099 hides a nuclear-weapon question in a VBScript comment to derail LLM malware scanners

ESET (WeLiveSecurity, 2026-09-10) named GuardBreaker: the Russia-aligned group UAC-0099 embedded a decoy prompt injection — a comment asking about building nuclear weapons — in a VBScript delivering its MATCHBOIL loader during an early-stage intrusion against…

ESET researchers (WeLiveSecurity, 2026-09-10) identified and named GuardBreaker, a prompt-injection technique used by the Russia-aligned threat actor UAC-0099 in an early-stage intrusion against a target in Ukraine; GBHackers (2026-09-11) and Cyber Security News (2026-09-11) both attribute the research to ESET and corroborate the details. The group embedded a safety-sensitive comment in a VBScript used to install its MATCHBOIL loader: the comment asks a question about building nuclear weapons, crafted so an LLM-powered analysis tool treats it as untrusted input, interprets it as an instruction, and refuses or stops analysis before the malicious code is read. The comment has no runtime effect; its purpose is to trip the AI scanner's safety guardrails at inference time. GBHackers describes MATCHBOIL as a C#-based loader used by UAC-0099 alongside MATCHWOK and DRAGSTARE, while Cyber Security News reports the loader is associated exclusively with the group. ESET also observed UAC-0099 checking for analysis tools such as IDA and Wireshark, indicating awareness of AI-based defenses. GBHackers adds that UAC-0099 has previously targeted Ukrainian government, defense, transportation, and energy sectors, and notes similar LLM-thwarting instruction-flooding tricks in malicious PyPI and npm packages reported by Socket and StepSecurity. By turning the AI triage process itself into the attack target, GuardBreaker risks missed detections or benign misclassification of malicious samples (Cyber Security News). Mitigations: ESET recommends multi-model cross-validation of AI-assisted analysis, treating absent LLM output as requiring further checks, and cross-checking AI triage results with static, behavioral, and human review; GBHackers cites OWASP guidance to treat code comments and metadata as untrusted input, sanitize it, never treat an LLM refusal as a clean verdict, and correlate LLM analysis with signatures, sandboxes, EDR, and human review. None of the three reports provides CVE identifiers, affected software versions, or victim counts, and the reports do not contradict one another.

• Technique named GuardBreaker by ESET (WeLiveSecurity, 2026-09-10) and attributed to the Russia-aligned threat actor UAC-0099; GBHackers and Cyber Security News (both 2026-09-11) attribute the research to ESET.
• Observed in an early-stage UAC-0099 intrusion against a target/organization in Ukraine.
• Mechanism: indirect prompt injection at inference time — a VBScript comment asking about building nuclear weapons is read as untrusted input by LLM-powered scanners and can trigger safety-guardrail refusal or truncated analysis before the…
• The decoy comment has no runtime effect (ESET).
• The VBScript downloads MATCHBOIL, a C#-based loader (GBHackers) associated exclusively with UAC-0099 (Cyber Security News); the group also uses MATCHWOK and DRAGSTARE (GBHackers).
• UAC-0099 also checked for analysis tools such as IDA and Wireshark, showing awareness of AI-based defenses.
• UAC-0099 has previously targeted Ukrainian government, defense, transportation, and energy sectors (GBHackers).
• Similar LLM-thwarting instruction-flooding tricks appeared in malicious PyPI and npm packages reported by Socket and StepSecurity (ESET/GBHackers).