UAC-0099 Enhances MATCHBOIL Malware Targeting Ukrainian Industries

• •MATCHBOIL is a C# downloader used by UAC-0099 targeting Ukrainian industries.
• •The malware is delivered via spear phishing emails and has evolved significantly since 2024.
• •ESET's telemetry shows all victims are located in Ukraine across multiple sectors.

ESET Research has documented the evolution of MATCHBOIL, a C# downloader used by the Russia-aligned group UAC-0099, which has targeted Ukrainian transportation, manufacturing, and energy sectors. The malware, first noted by CERT-UA in August 2025, has been under development since at least April 2024. MATCHBOIL is delivered via spear phishing emails containing malicious links that download a VBScript file, which then executes the downloader. ESET's telemetry indicates that all observed victims are in Ukraine, with notable targets including transportation companies in mid-2025, a manufacturing firm in late 2025, and an energy company in June 2026. The malware has undergone significant changes, including improved obfuscation techniques and sandbox evasion capabilities, making it harder to detect. The latest version, as of April 2026, can communicate with its command-and-control server every two minutes, enhancing its persistence and functionality. ESET researchers emphasize that MATCHBOIL is a crucial tool in UAC-0099's cyberespionage operations.