Evolution of MATCHBOIL Malware Used by UAC-0099 APT Group
ESET researchers have documented the evolution of the MATCHBOIL malware, a custom C# downloader utilized by the Russia-aligned UAC-0099 APT group. This malware is designed to download a payload from the group's command and control (C&C) server, install it, and ensure its persistence on the victim's machine. Although MATCHBOIL was first reported by CERT-UA in August 2025, evidence suggests it has been in development since at least 2024, with the earliest versions analyzed dating back to April 2024 and the latest to April 2026. This article reviews these versions chronologically, detailing the malware's enhancements over time.
The investigation into MATCHBOIL began in February 2026, following the upload of two samples to VirusTotal that communicated with a domain linked to UAC-0099. This prompted a deeper analysis, revealing earlier samples from November and December 2025, which are believed to be variants of MATCHBOIL. Further research uncovered even older samples from April 2024, indicating that UAC-0099 was likely developing MATCHBOIL well before its public documentation.
The telemetry data collected by ESET shows that all identified MATCHBOIL victims were located in Ukraine, spanning various sectors. From July to August 2025, the malware was detected at multiple transportation companies, and in December of the same year, it was found at a manufacturing firm. By June 2026, additional samples were registered at a company in the energy sector. Notably, the two samples uploaded to VirusTotal in February 2026 also originated from Ukraine.
UAC-0099 is known for targeting governmental organizations, financial institutions, and media outlets in Ukraine, suggesting a medium confidence alignment with Russian interests. The group has been active since at least 2022 and was first reported by CERT-UA in June 2023. Besides MATCHBOIL, UAC-0099 typically deploys LONEPAGE, a PowerShell downloader named for the presence of the word 'page' in its C&C URLs.
MATCHBOIL operates by downloading another payload from its C&C server, installing it, and establishing persistence. The malware is typically distributed through malicious links in spearphishing emails. When a victim clicks the link, it downloads an archive file containing a VBScript payload that executes MATCHBOIL on the victim's machine. For the malicious payload to take effect, the victim must be misled into executing the script manually.
At runtime, MATCHBOIL checks for the existence of a specific directory in %LOCALAPPDATA% to install the payload. If the directory already exists, the malware terminates. During execution, it collects basic information about the victim machine, such as the CPUID and BIOS serial number, which is used for identification during C&C communication.
MATCHBOIL performs three HTTPS requests to the C&C server, each serving a different purpose. Analysis indicates that the hex-encoded payload installed on the victim's machine is a C# backdoor known as MATCHWOK, which is exclusively used by UAC-0099 and was first documented by CERT-UA.
Ensuring Malware Persistence and Configuration
Once the C&C communication concludes, MATCHBOIL ensures the installed payload's persistence, which can be achieved through scheduled tasks or by modifying the Windows registry. The persistence mechanism for MATCHBOIL itself is established via the VBScript used to download and install the malware. Recent telemetry has revealed a related VBScript sample that persists a C# loader executing MATCHBOIL.
The configuration of MATCHBOIL is hardcoded within the samples, containing strings related to C&C communication, directories, and filenames for installation. Earlier samples encrypted these strings, while the latest versions contain them in clear text or encrypted due to the obfuscator .NET Reactor. Over the nearly two-year period analyzed, UAC-0099 has made significant improvements to the downloader's code, particularly regarding its sophistication and evasion techniques.
The earliest MATCHBOIL samples from 2024 featured obfuscated class and method names using unprintable Unicode symbols. The strings in these binaries were encrypted with a custom algorithm combining XOR operations and bitwise shifts. As the malware evolved, it began to retrieve more detailed information about the victim's machine, including the username and MAC address of the network interface.
In the later versions, the malware's logic shifted to asynchronous tasks, enhancing its operational efficiency. The persistence mechanisms also evolved, with newer samples creating registry entries in the Run key. By late 2025, UAC-0099 introduced a graphical user interface (GUI) disguised as a daily planner, which is displayed if MATCHBOIL is executed manually. This version of the malware also incorporated checks to determine if it was running in a sandbox environment, allowing it to evade detection.
Cleared to File
In 2026, several distinct MATCHBOIL samples were identified, with minor changes observed in February. The most recent variant, discovered in April, marked a significant shift as it was the first MATCHBOIL sample to be a DLL file executed by a custom C# loader, indicating ongoing development and adaptation by UAC-0099.
Overall, the evolution of MATCHBOIL reflects UAC-0099's commitment to enhancing its malware capabilities, demonstrating a continuous effort to adapt to changing cybersecurity landscapes and improve its effectiveness in cyber espionage operations.
