ESET researchers have tracked two years of continuous updates to MATCHBOIL, a Windows malware downloader deployed by the Russia-aligned threat group UAC-0099. ESET telemetry indicates that the threat actor has expanded beyond its historical targeting of Ukrainian government bodies, financial institutions, and media organizations, compromising transportation companies in July and August 2025, a manufacturing firm in December 2025, and an energy supplier in June 2026.
Payload Delivery and Espionage Capabilities
The attack sequence begins with a link in a spear-phishing email that downloads an archive containing a VBScript file, which then fetches and executes MATCHBOIL. Upon launch, the downloader fingerprints the host computer using its CPU ID and BIOS serial number before sending three HTTPS requests to a command-and-control server. The server delivers HTML containing a hex-encoded payload, which MATCHBOIL extracts, writes to a directory inside %LOCALAPPDATA%, and configures to launch automatically via Windows registry keys or scheduled tasks. If the destination directory already exists, the downloader terminates.
MATCHBOIL serves primarily to deliver MATCHWOK, a C#-based backdoor designed for cyber espionage. ESET reports that MATCHWOK can execute arbitrary PowerShell commands and capture desktop screenshots. To hamper security analysis, UAC-0099 regularly altered file names and folder structures, shifting from a directory named DeviceMonitor in 2024 to MeowCheck in late 2025, and later to an SMTPClient directory in April 2026.
Refined Sandbox Evasion and Technical Updates
Between late 2025 and early 2026, UAC-0099 upgraded MATCHBOIL with enhanced anti-analysis techniques. The group replaced its custom string scrambling with Eziriz .NET Reactor, a commercial obfuscator that virtualizes code and obfuscates control flow. Developers also implemented a two-minute execution timer so the malware could retry server connections continuously rather than failing after a single attempt.
To evade automated security sandboxes, late 2025 builds inspect Windows event logs in both English and Russian, verifying that at least three system uptime events reflect two hours or more of operation. An April 2026 update introduced a secondary check ensuring the host operating system was installed at least ten days prior. For manual launches, late 2025 variants display a basic decoy daily planner window titled "Dairy" featuring a cat photo and text boxes labeled "Today."
Role as an Initial Access Broker
ESET attributes UAC-0099 to Russian state interests with medium confidence, characterizing the group as an initial access broker that secures network footholds and hands control to other threat actors, such as Sandworm. Although Ukraine’s CERT-UA first documented MATCHBOIL in August 2025, compilation timestamps show the downloader was functional as early as mid-2024. The group hosts its infrastructure on rented virtual private servers from providers including BitLaunch, proxying traffic through Cloudflare and generating unique Let's Encrypt certificates for each domain.
AI-generated editorial illustration; not a documentary photograph.
Source: What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor
SIGNAL TITANS
Leave a Reply