Threat actor targeting Ukrainian transportation, energy, and manufacturing organizations with malware such as the MatchBoil downloader and ASHVEIN RAT.
UAC-0099's ASHVEIN malware carries a nuclear-weapons prompt meant to make an LLM analyst refuse the script, a dev.to post says. The post tests no model, but any pipeline that sends a whole script to an LLM in one prompt can check itself for the flaw.
Reality
ESET says UAC-0099 has reworked its MatchBoil downloader since at least July 2024, with the newest version appearing in April 2026. Repeated changes aimed at security software mean indicators from CERT-UA's August 2025 write-up describe an older build.
Perspective Coverage
4 publishersReality
UAC-0099, a Russia-aligned group, has pushed its MATCHBOIL downloader from Ukrainian transport firms into a manufacturer and an energy company, ESET says. The researchers tracked the tool for almost two years; it installs MATCHWOK, a C# backdoor that grabs screenshots and runs PowerShell.
Reality
TrendAI has tied ASHVEIN, a previously undocumented .NET RAT, to UAC-0099 attacks on Ukrainian government personnel, citing five builds from October 2025. The group has fielded newer tools since, so detection that lasts has to target how it delivers and tasks its implants.
Reality
ESET found the bait comment in a loader for MATCHBOIL, malware it ties exclusively to the Russia-aligned group that feeds targets to Sandworm. The trick works because a model that refuses to read a file returns no verdict at all.
Reality
ESET calls the technique GuardBreaker and notes that this bait, unlike most evasion tricks, is left in plain sight for the models reading the code to find.
Reality