UAC-0099's MATCHBOIL Malware Targets Ukrainian Industries

• •MATCHBOIL is a C# downloader used by UAC-0099, targeting Ukrainian industries.
• •The malware has evolved significantly since its initial documentation in August 2025.
• •All identified victims are located in Ukraine, including sectors like transportation and energy.

ESET Research has documented the evolution of MATCHBOIL, a C# downloader used by the Russia-aligned group UAC-0099 to target various sectors in Ukraine, including transportation, manufacturing, and energy. The malware, first noted by CERT-UA in August 2025, has been in development since at least April 2024. It is delivered via spear phishing emails containing malicious links that download a VBScript file, which in turn executes MATCHBOIL. The downloader has evolved to include sophisticated obfuscation techniques and persistence mechanisms, such as scheduled tasks and registry modifications. All victims identified in ESET's telemetry were located in Ukraine. The malware's payload, known as MATCHWOK, is a backdoor that enables espionage capabilities on infected machines. ESET researchers have observed multiple iterations of MATCHBOIL, with the latest version from April 2026 demonstrating advanced evasion techniques against sandbox environments. UAC-0099 continues to be a significant threat to Ukrainian governmental and industrial sectors.