Loading malware…
BURNYBEAR is a .NET-based Windows loader used by the Russia-aligned threat cluster UAC-0099, also tracked as Earth Sirrush. Documented in July 2026 campaigns against Ukrainian organizations, it loads and executes MATCHBOIL.V2, an updated C# loader responsible for retrieving and executing additional payloads. When launched without the expected command-line arguments, BURNYBEAR activates resource-exhaustion logic that consumes substantial RAM and CPU resources.
Its observed delivery chain begins with phishing emails containing linked images that direct recipients through shortened URLs to file-sharing services. Downloaded ZIP archives contain VBScript files disguised as PDF documents through double extensions and whitespace padding. Executing the script displays a decoy document and retrieves a package containing legitimate Notepad++ software alongside LUNCHPOKE, a malicious plugin. LUNCHPOKE executes through Notepad++’s normal plugin-loading mechanism, extracts BURNYBEAR and MATCHBOIL.V2 from a password-protected archive, and establishes a scheduled task that launches BURNYBEAR every three minutes. This chain abuses legitimate application functionality rather than requiring exploitation of a Notepad++ vulnerability. UAC-0099’s broader espionage targeting includes Ukrainian government, defense, border-security, transport, and logistics organizations.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
These files include components like BurnyBear, a loader for the MatchBoil V2 malware, and RemoteLibUpdater.exe, which updates command-and-control addresses and uses WinRAR to extract downloaded payloads.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
The infection chain typically begins with a phishing email containing an image attachment.
When the user clicks the image, a hyperlink often routed through a URL-shortening service is activated and redirects the user to a file-hosting platform.
LUNCHPOKE, the DLL is designed to unpack the RAR archive... to a specific directory, set up persistence by means of a scheduled task to run "RemoteLibUpdater.exe" every three minutes.
Persists ResourceExplorer.exe via schtasks.exe LOLBin copy ... scheduled task Helpers\Resources running every 5 minutes with finderstart argument.
У згаданому архіві міститься VBS-скрипт... у разі запуску скрипт забезпечить завантаження файлу-приманки...
RemoteLibUpdater.exe is BURNYBEAR, a loader whose job is to execute InitTest.dll. That DLL is a modified version of MATCHBOIL
У згаданому архіві міститься VBS-скрипт із подвійним розширенням... У свою чергу, у разі запуску скрипт забезпечить завантаження файлу-приманки...
LUNCHPOKE, the DLL is designed to unpack the RAR archive... to a specific directory, set up persistence by means of a scheduled task to run "RemoteLibUpdater.exe" every three minutes.
Persists ResourceExplorer.exe via schtasks.exe LOLBin copy ... scheduled task Helpers\Resources running every 5 minutes with finderstart argument.
LUNCHPOKE, the DLL is designed to unpack the RAR archive... to a specific directory, set up persistence by means of a scheduled task to run "RemoteLibUpdater.exe" every three minutes.
Persists ResourceExplorer.exe via schtasks.exe LOLBin copy ... scheduled task Helpers\Resources running every 5 minutes with finderstart argument.
The ZIP file contains a Visual Basic Script (VBScript) that masquerades as a PDF document.
Store C&C configuration in .library-ms files (an uncommon file extension that blends with Windows Libraries).
if “RemoteLibUpdater.exe” is launched incorrectly, namely without specifying arguments, BURNYBEAR instead activates logic designed to exhaust computer resources... it provides a rough sandbox detection mechanism
Checks whether the operating system was installed within the previous 10 days (DAYS_LIMIT=10) to identify and avoid potential sandbox environments.
if “RemoteLibUpdater.exe” is launched incorrectly, namely without specifying arguments, BURNYBEAR instead activates logic designed to exhaust computer resources... it provides a rough sandbox detection mechanism
Checks whether the operating system was installed within the previous 10 days (DAYS_LIMIT=10) to identify and avoid potential sandbox environments.
extracts the contents of the RAR file, including RemoteLibUpdater.exe and InitTest.dll
The dropper downloads TFU_up.bin ... and saves it to C:\Users\Public\Documents\TFU_up.exe.
triggering a resource exhaustion attack targeting the host’s RAM and CPU.
45 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.