Loading malware…
BURNYBEAR is a .NET-based Windows loader used by the Russia-aligned threat cluster UAC-0099, also tracked as Earth Sirrush. Documented in July 2026 campaigns against Ukrainian organizations, it loads and executes MATCHBOIL.V2, an updated C# loader responsible for retrieving and executing additional payloads. When launched without the expected command-line arguments, BURNYBEAR activates resource-exhaustion logic that consumes substantial RAM and CPU resources.
Its observed delivery chain begins with phishing emails containing linked images that direct recipients through shortened URLs to file-sharing services. Downloaded ZIP archives contain VBScript files disguised as PDF documents through double extensions and whitespace padding. Executing the script displays a decoy document and retrieves a package containing legitimate Notepad++ software alongside LUNCHPOKE, a malicious plugin. LUNCHPOKE executes through Notepad++’s normal plugin-loading mechanism, extracts BURNYBEAR and MATCHBOIL.V2 from a password-protected archive, and establishes a scheduled task that launches BURNYBEAR every three minutes. This chain abuses legitimate application functionality rather than requiring exploitation of a Notepad++ vulnerability. UAC-0099’s broader espionage targeting includes Ukrainian government, defense, border-security, transport, and logistics organizations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These files include components like BurnyBear, a loader for the MatchBoil V2 malware, and RemoteLibUpdater.exe, which updates command-and-control addresses and uses WinRAR to extract downloaded payloads.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
LUNCHPOKE, the DLL is designed to unpack the RAR archive... to a specific directory, set up persistence by means of a scheduled task to run "RemoteLibUpdater.exe" every three minutes.
Persists ResourceExplorer.exe via schtasks.exe LOLBin copy ... scheduled task Helpers\Resources running every 5 minutes with finderstart argument.
У згаданому архіві міститься VBS-скрипт... у разі запуску скрипт забезпечить завантаження файлу-приманки...
The ZIP file contains a Visual Basic Script (VBScript) that masquerades as a PDF document.
Store C&C configuration in .library-ms files (an uncommon file extension that blends with Windows Libraries).
45 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
.NET loader listed among UAC-0099's tools used during April–July 2026.
A .NET loader deployed by the malicious LUNCHPOKE plugin in Earth Sirrush's Ukrainian espionage operations. Its individual loading behavior is not detailed.
.NET loader deployed by the malicious LUNCHPOKE plugin in Earth Sirrush's attacks against Ukrainian organizations. The content does not detail its individual loading mechanism.
Named malware mentioned in the discussion of UAC-0099's infection chain. The content does not establish its specific functionality or whether it contains the AI-disruption prompt.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.