UAC-0099 Refines MATCHBOIL to Deploy Espionage Backdoor in Ukrainian Organizations

Russia-aligned threat group UAC-0099 has progressively refined the MATCHBOIL downloader to deploy the MATCHWOK espionage backdoor on Windows systems in Ukraine, according to ESET. Observed victims included transportation companies in July and August 2025, a manufacturer in December 2025, and an energy company in June 2026. The spear-phishing chain uses links to archives containing VBScript files that download and execute MATCHBOIL, which collects victim identifiers, retrieves a concealed payload and installs the C# backdoor. Persistence is established through scheduled tasks or registry keys.

Tracked since at least April 2024, MATCHBOIL has gained recurring command-and-control communication, repeated execution, revised persistence, commercial obfuscation, sandbox checks and deceptive graphical interfaces. The newest reported 2026 variant replaces an executable with a DLL run by a custom C# loader. ESET assesses UAC-0099’s alignment with Russian interests with medium confidence and reports that it can act as an initial access broker for Sandworm, Russia’s military intelligence Unit 74455; however, access transfers involving these victims were not established. Defenders should prioritize detection of archive-delivered VBScript, suspicious persistence changes and unusual C# loader activity.