Sandworm wiped a Ukrainian logistics firm after UAC-0099 access
ESET says MythicRatatoskr used a Yggdrasil mesh C2, and Sandworm wiped systems with SDelete on September 17, 2025.
Stories per day · 30 days
2 RSS
16 stories, newest first · one card per story
Stories tagged #uac-0099
UAC-0099 handed Ukraine grain firm access to Sandworm
MythicRatatoskr used Yggdrasil for C2; Sandworm later wiped data with SDelete via Group Policy.
Sandworm wiped a Ukrainian grain firm after UAC-0099 access
ESET says a July 2025 phishing foothold led to a September wipe, using a new backdoor that talked over Yggdrasil.
MATCHBOIL Malware Uses Cloudflare-Hidden C2 Servers to Deliver Backdoor Payloads
UAC-0099's MATCHBOIL downloader hides C2 behind Cloudflare and delivers MATCHWOK to Ukrainian firms.
MATCHBOIL Malware Adds Sandbox Checks, .NET Reactor Obfuscation and Persistent C2
UAC-0099's MATCHBOIL downloader evolved with sandbox checks, .NET Reactor obfuscation, scheduled-task persistence, and recurring C2, hitting Ukrainian transport and energy firms.
Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift
Cyber-espionage actor UAC-0099 has upgraded its MatchBoil dropper with stealthier capabilities for ongoing campaigns against Ukrainian organizations.
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML
Russia-aligned UAC-0099 deployed the ASHVEIN RAT against Ukrainian government staff, hiding tasking in HTML.
Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware
ESET documents two years of UAC-0099 upgrades to its MATCHBOIL downloader used in espionage against Ukrainian government, energy and transport sectors.
Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms
UAC-0099 upgraded MatchBoil malware in espionage attacks on Ukrainian transport and energy firms.
What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor
Russia-aligned UAC-0099 uses MATCHBOIL to install the MATCHWOK spy backdoor on Ukrainian transport, manufacturing, and energy firms.
Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine
Earth Sirrush has spear-phished Ukrainian government and logistics since 2022, possibly feeding Sandworm.
8
Russia-Aligned Hackers Use GuardBreaker Prompt Injection to Disrupt AI Malware Analysis
Russia-aligned group UAC-0099 embeds GuardBreaker prompt injection in a VBScript comment to make AI malware scanners refuse analysis of a MATCHBOIL loader.
4
Hackers Weaponize AI Safety Guardrails to Hide Malware From LLM-Powered Security Scanners
ESET says Russia-aligned actor UAC-0099 hid guardrail-triggering comments in VBScript to derail LLM-based malware scanners in Ukraine.
7
GuardBreaker: Derailing AI-assisted malware analysis with a code comment
ESET names 'GuardBreaker': UAC-0099 embeds a nuclear-weapon question in VBScript comments to trip LLM scanner guardrails during analysis of its MATCHBOIL loader.
7
Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis
Russia-aligned UAC-0099 planted a nuclear-weapon prompt inside malicious VBS scripts to derail LLM-based malware analysis targeting Ukraine.
4
Russian hackers plant nuclear weapon prompt in malware to trip AI safety guardrails
ESET reports Russian group UAC-0099 hid a prompt in VBS malware comments to trip AI safety filters and disrupt automated malware analysis in Ukraine.
3