UAC-0099 Enhances MATCHBOIL Malware with Advanced Features
A Russia-aligned cyber espionage group, UAC-0099, has made notable advancements to its MATCHBOIL downloader over the past two years. Recent research published by ESET on October 8 reveals that the malware has undergone several upgrades, including enhanced obfuscation, sandbox detection capabilities, and changes to its execution and payload persistence mechanisms.
ESET's analysis, which covers MATCHBOIL versions compiled or observed between April 2024 and April 2026, shows a clear trend of increasing sophistication with each iteration. The group has been linked to attacks on Ukrainian government entities, financial institutions, and media outlets, with ESET assessing the group's alignment with Russian interests at a medium confidence level.
Victims of MATCHBOIL have been identified across various sectors in Ukraine, including transportation, manufacturing, and energy, with activity recorded as recently as June 2026. Initially documented by Ukraine's Computer Emergency Response Team (CERT-UA) in August 2025, earlier samples of MATCHBOIL suggest that its development may have started as early as April 2024. The downloader, written in C#, is designed to retrieve, install, and maintain persistence for additional payloads.
The earlier versions of MATCHBOIL utilized unprintable Unicode characters and string encryption to complicate code inspection. However, by late 2025, UAC-0099 transitioned to using the Eziriz .NET Reactor obfuscator, which employs code virtualization and control-flow obfuscation techniques. This shift indicates a strategic move to enhance the malware's resilience against analysis.
Evasion Techniques and Execution Model Changes
Additionally, the later samples introduced checks to determine if MATCHBOIL was operating within a sandboxed environment, suggesting a deliberate effort to evade detection. This evolution in capabilities has been observed gradually since late 2025, reflecting a commitment to making automated inspection more challenging.
The execution model of MATCHBOIL has also evolved. Earlier iterations functioned as one-shot downloaders, while a version from late 2025 was designed to operate on a two-minute timer, allowing it to fetch newer payloads from its command-and-control server. The persistence mechanisms have changed as well, with the 2024 samples combining a Windows Registry Run key with a scheduled task, while later versions reverted to using scheduled tasks exclusively.
Approved for Dissemination
In a notable development, late-2025 samples introduced a graphical interface resembling a daily planner, which appeared when MATCHBOIL was executed manually. However, researchers noted inconsistencies that detracted from its intended disguise. A February 2026 sample displayed a more subtle utility for searching text files with regular expressions, indicating a shift in operational focus.
The ongoing enhancements to MATCHBOIL suggest that UAC-0099 views this malware as a dynamic component of its cyber toolkit rather than a static downloader. ESET concluded that this reflects the operators' keen interest in refining their downloader to evade detection by security measures and to utilize it effectively in future cyber operations.
