Russia aligned group upgrades MATCHBOIL malware used against Ukrainian targets

The Russia-aligned cyber espionage group UAC-0099 has steadily upgraded its MATCHBOIL downloader to target organizations in Ukraine, according to research published by ESET on October 8. InfoSecurity Magazine and Help Net Security both reported that ESET tracked changes to the malware compiled or observed between April 2024 and April 2026. Dark Reading and The Manila Times also reported that the group has refined the tool during its campaigns. [1][2][3][4]

ESET researchers found that each new version of MATCHBOIL added stronger obfuscation, sandbox checks, and modifications to execution and payload persistence. Help Net Security reported that UAC-0099 uses the downloader to plant a second program on Windows machines. The upgrades have made the malware increasingly difficult for security analysts to examine. [1][2]

According to Help Net Security, all victims in ESET telemetry were located in Ukraine. The group targeted transportation companies in July and August 2025, a manufacturer in December 2025, and an energy firm in June 2026. InfoSecurity Magazine noted that UAC-0099 has additionally targeted Ukrainian government organizations, financial institutions, and media entities. [1][2]

InfoSecurity Magazine reported that ESET assesses with medium confidence that UAC-0099 aligns with Russian interests. The continued evolution of MATCHBOIL shows that the group is actively maintaining its cyber espionage tools to sustain access to critical Ukrainian infrastructure and computer networks. [1][2][3][4]