MATCHBOIL: The Malware Behind UAC-0099's Espionage Operations
ESET researchers have tracked nearly two years of developments related to MATCHBOIL, a downloader employed by the Russia-aligned group UAC-0099 to install a secondary program on Windows machines in Ukraine. The telemetry data from ESET indicates that all identified victims were located in Ukraine, including transportation companies targeted in July and August 2025, a manufacturer in December 2025, and an energy company in June 2026. The secondary program installed by MATCHBOIL is a spying tool, potentially useful to other groups as well.
According to ESET researcher Fernando Tavella, MATCHBOIL downloads a payload known as MATCHWOK, a C# backdoor capable of espionage activities on the victim's machine. This includes functionalities such as taking screenshots of the victim's desktop and executing PowerShell commands remotely. The malware's delivery mechanism begins with a link embedded in a spear phishing email. This link downloads an archive containing a VBScript file, which subsequently downloads and executes MATCHBOIL.
Upon execution, MATCHBOIL fingerprints the machine by collecting the CPU ID and BIOS serial number, followed by making three HTTPS requests to the group's server. The second response contains HTML with the payload concealed as hex-encoded text, which MATCHBOIL extracts and saves to a folder under %LOCALAPPDATA%. It then sets the payload to relaunch via a scheduled task or a Windows registry key. If the designated folder already exists, MATCHBOIL will terminate its operation.
Over time, the location of the payload has shifted. In 2024, it was stored in a folder named DeviceMonitor. By late 2025, it was found as MeowMeowProgramm.exe in a folder called MeowCheck, and by April 2026, it had changed to SMTPClientApplication.exe in a folder named SMTPClient, with a scheduled task labeled Checker under a directory called MailClient. These names are crucial for anyone conducting searches on infected machines.
The earlier versions of MATCHBOIL operated once and relied on persistence settings for continued operation. However, by late 2025, the malware began running on a two-minute timer, ensuring that a failed initial contact with the server would not end the infection. Additionally, it replaced its custom string scrambling with a commercial obfuscator, Eziriz .NET Reactor, which can virtualize code and complicate its control flow.
Evasion Tactics and User Deception
The malware has also incorporated sandbox evasion techniques. MATCHBOIL examines Windows event logs for system uptime, looking for records in both English and Russian. It determines that it is not in a sandbox if it finds at least three events indicating 7,200 seconds (two hours) or more of uptime. The April 2026 version introduced a further check to see if the operating system was installed at least ten days prior to the malware's execution.
The decoy mechanisms are less sophisticated. Late 2025 builds displayed a daily planner with a cat photo to users who manually launched them. This window was titled "Dairy," with both text boxes labeled "Today."
UAC-0099 has previously targeted government bodies, financial institutions, and media in Ukraine, making the recent attacks on transportation, manufacturing, and energy sectors notable. When asked if this indicates an expanded target list, Tavella referenced the group's history, suggesting that UAC-0099 may be broadening its scope to maximize its impact in Ukraine. The group has previously acted as an initial access broker for Sandworm, another Russia-aligned APT group, indicating that they may be seeking victims of interest for other APT groups they can assist.
Case Closed
An initial access broker infiltrates networks and provides that access to other entities. ESET attributes UAC-0099 to Russian interests with medium confidence based on its targeting patterns. Ukraine's CERT-UA documented MATCHBOIL in August 2025, with compilation timestamps in the samples indicating that the tool likely operated for about a year before being publicly reported.
UAC-0099 utilizes virtual servers from providers like BitLaunch and employs Cloudflare for additional security. ESET has noted that the Let’s Encrypt certificates used by the group are not reused across different domains.
