UAC-0099 Uses GuardBreaker to Evade AI Malware Detection

Thehackernews

UAC-0099 Uses GuardBreaker to Evade AI Malware Detection

First seen 1 Sep 2026, 08:58 UTC • •77.7

Article Content

1 / 12

Browse articles

ThreatCluster •September 2, 2026 at 08:45 UTC

•UAC-0099 uses GuardBreaker to evade AI detection.
•Malicious VBS scripts contain prompts to distract AI systems.
•Targets include Ukrainian organizations in critical sectors.

Russian-linked hackers from the group UAC-0099 have developed a new technique called GuardBreaker to evade AI-assisted malware analysis. This method involves embedding a nuclear weapon prompt in malicious VBS scripts, which distracts AI systems from analyzing the actual malware code. The script is designed to download and install MATCHBOIL, a loader used exclusively by UAC-0099 to deliver additional payloads. The attack primarily targets Ukrainian organizations, particularly in the transportation and energy sectors. ESET, a Slovak cybersecurity firm, reported this technique and linked it to UAC-0099's ongoing operations. The Computer Emergency Response Team of Ukraine (CERT-UA) has documented similar tactics used by the group, highlighting their evolving methods. This incident underscores the growing sophistication of cyber threats leveraging AI manipulation.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 44d ago How this analysis works

Timeline

2026-07-01

CERT-UA warns of UAC-0099 activity

CERT-UA documented changes in UAC-0099's tactics, including the use of malicious VBS files disguised as Notepad++ plugins.

2026-08-31

ESET reports GuardBreaker technique

ESET disclosed UAC-0099's use of GuardBreaker to evade AI malware analysis, embedding a nuclear prompt in VBS scripts.

Feeds2.Feedburner

Recent

UAC-0099 targets Ukrainian sectors

UAC-0099 has been actively targeting organizations in Ukraine's transportation and energy sectors with evolving malware techniques.

More articles in this cluster (11)

Threat Graph

9 entities, 14 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Threat Actor (2)

Uac-0099
hades

Technique (5)

Malware
Supply Chain Attack
T1059.005 - Visual Basic
T1105 - Ingress Tool Transfer
T1195 - Supply Chain Compromise

Malware (2)

Miasma
MatchBoil

Relationships

Uac-0099 uses Miasma
Uac-0099 uses MatchBoil
hades uses Miasma
hades uses MatchBoil
Uac-0099 uses Malware
Uac-0099 uses Supply Chain Attack
Uac-0099 uses T1059.005 - Visual Basic
Uac-0099 uses T1105 - Ingress Tool Transfer
Uac-0099 uses T1195 - Supply Chain Compromise
hades uses Malware
hades uses Supply Chain Attack
hades uses T1059.005 - Visual Basic
hades uses T1105 - Ingress Tool Transfer
hades uses T1195 - Supply Chain Compromise

Following this threat?

Track hades, Uac-0099 and Miasma in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

UAC-0099 Enhances MATCHBOIL Malware Targeting Ukrainian Industries ESET Research has documented the evolution of MATCHBOIL, a C# downloader used by the Russia-aligned group UAC-0099, which has targeted Ukrainian transportation, manufacturing, and energy sectors. The malware, first noted by CERT-UA in August 2025, has been under development since at least April 2024. MATCHBOIL is…

UAC-0099 Targets Ukrainian Government with ASHVEIN Malware The Russia-aligned threat actor UAC-0099 has been linked to a new .NET infostealer and RAT named ASHVEIN, targeting Ukrainian government personnel. This malware, also referred to as 'TelemetryBrowser,' features capabilities such as credential theft from Chrome and Firefox, screenshot capture, and remote shell…