Loading story…
ESET identified GuardBreaker, a prompt-injection anti-analysis technique deployed by Russia-aligned UAC-0099 against a Ukrainian target. The group embedded a VBScript comment asking for instructions to build a nuclear weapon, apparently intended to make an LLM-based code scanner issue a safety refusal before analyzing the malicious portions of the file.
The VBScript was designed to download and install MATCHBOIL, UAC-0099’s loader for delivery of further payloads. The activity demonstrates that AI-assisted malware-analysis workflows can be manipulated through untrusted code content; organizations should use layered detection and validation controls, explicitly handle model refusals or incomplete analysis, and retain human review for suspicious files.
Track how attackers are adapting to this technology.
1 event from the most recent confirmed update back to the earliest known activity.
ESET identified the Russia-aligned UAC-0099 group using a GuardBreaker prompt-injection comment in a VBScript during the early stages of an attack against a target in Ukraine. The comment sought to trigger an LLM scanner's safety refusal while the script was designed to download and install the MATCHBOIL loader.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourcewelivesecurity.com
Open sourcecert.gov.ua
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ESET reported that the UAC-0099 threat group used **GuardBreaker**, an AI-focused anti-analysis technique, against a Ukrainian organization. A malicious prompt embedded in a VBS code comment attempts to trigger an LLM's safety controls before it evaluates the malware; the script then downloads the C# **MATCHBOIL** loader for follow-on payload delivery. The technique targets analysis pipelines that submit untrusted file contents to an LLM without separating code and embedded data from instructions. Related reporting describes earlier malware samples, including a partially developed sample dubbed Skynet, that embedded prompts directing AI tools to ignore previous instructions and report “NO MALWARE DETECTED.” The samples also used obfuscation, sandbox and debugger evasion, data collection, Tor functionality, and artifact cleanup. Testing cited in the reporting found OpenAI o3 and GPT-4.1 resisted the observed injection, but defenders should treat LLM findings as triage only and validate them with signature-based detection, behavioral analysis, and manual reverse engineering.
Sep 7, 2026
CERT-UA warned that the **UAC-0099** threat cluster has shifted its delivery chain against organizations in Ukraine, using phishing emails with image attachments and shortened links to deliver ZIP archives containing a double-extension VBS file. That script retrieves a decoy document and an archive bundling a legitimate **Notepad++ 8.8.3** installer with a malicious `NppExport.dll`, abusing the editor’s normal plugin-loading behavior rather than a supply-chain compromise or software vulnerability. The archive also includes additional components such as `updater.rar` and, in some cases, **WinRAR**, which the malware can also fetch from Dropbox if it is not already present. Once launched, the fake Notepad++ plugin installs **LunchPoke**, which extracts a password-protected archive, creates persistence through a scheduled task, and starts **BurnyBear** to load `InitTest.dll`, a modified **MatchBoil V2** implant. CERT-UA said MatchBoil V2 continues to receive updated configuration data, including command-and-control infrastructure and follow-on payloads; published indicators include the domain `kaufen-qpon[.]icu` and IP `64.94.84[.]204`. The agency added that UAC-0099 has previously been linked to initial access activity associated with **APT44 (Sandworm)** operations.
Aug 31, 2026
Researchers reported that **UAC-0184**—also tracked as **UNC5435** and **MB-0007**—is using spearphishing **LNK** files with Ukraine- and Cyrillic-themed lures to launch a multi-stage malware chain against Ukrainian targets. The lures invoke **`bitsadmin`** and **`mshta`** to retrieve HTA payloads from disposable infrastructure hosted on **Cloudflare Pages**, **Netlify**, and novelty TLDs, then fetch **`dctrprraclus.zip`**. The HTA stager hides malicious logic behind decoy HTML padding and embedded VBScript, which starts PowerShell to decrypt an **AES-256-CBC** base64 blob using a co-located 32-byte ASCII key and a null IV, decompress the result with gzip, and reflectively load a .NET assembly; researchers said the actor's per-sample key rotation offers little protection because the key is shipped with the ciphertext. The intrusion set now includes two signed third-party sideloading paths for the same payload family. One chain abuses legitimate **Plane9** components, progressing through **`Cluster-Overlay64.exe`**, **`Plane9Engine.dll`**, **`openvr_api.dll`**, **`kernel-diag.lib`**, and a decoded **`evr.dll`** stage that extracts **`filter.bin`**, whose pseudo-PNG **IDAT** data is XOR-decoded and **LZNT1**-decompressed into a final bundle. A parallel path uses the signed **Bitdefender Endpoint Security** deployer **`bddeploy.exe`** to sideload a malicious **`deploy.dll`** via DLL search order hijacking. The final stages include signed utilities such as Microsoft-signed **`VSLauncher.exe`** and a PassMark-derived **`input.dll`** believed to provide covert networking and possible process-dump capability, while telemetry tied to **trojan.leopard/bitsuh** and multicast or TCP traffic on **port 31339** has emerged as a consistent hunting lead.
Jun 29, 2026