KYIV / BRATISLAVA — Cybersecurity researchers have revealed a systematic, multi-year evolution of a cyber espionage toolset deployed against critical infrastructure in Ukraine. According to comprehensive new intelligence published by European cybersecurity firm ESET, a Russia-aligned threat actor tracked as UAC-0099 has spent at least two years steadily upgrading its custom malware, known as MATCHBOIL.
The findings, released in October, trace the development and deployment of successive iterations of the C#-based downloader from April 2024 through mid-2026. The research highlights an aggressive, iterative approach to software development by state-sponsored actors, who are continuously enhancing their capabilities to bypass advanced endpoint detection and response (EDR) platforms, evade automated analysis sandboxes, and maintain persistent access to high-value networks.
The ongoing campaign underscores the persistent and adaptable nature of cyber warfare targeting Ukraine. While initial sightings of MATCHBOIL were only formally cataloged by emergency responders in late 2025, ESET’s retrospective analysis demonstrates that the threat group has been refining the codebase for years, treating the utility not as a disposable script, but as a core, highly engineered pillar of its espionage operations.
Main Facts
At its core, MATCHBOIL is a sophisticated downloader written in C#. Its primary objective within the UAC-0099 cyber kill chain is to infiltrate a compromised Windows environment, communicate with a command-and-control (C2) server, fetch subsequent payloads, execute them, and establish robust persistence mechanisms to survive system reboots.
The malware has been central to cyber espionage operations targeting Ukrainian organizations across strategically vital sectors, including:
- Transportation: Logistics networks and supply chain infrastructure.
- Manufacturing: Industrial and production facilities critical to wartime resilience.
- Energy: Power generation and distribution nodes essential for civil infrastructure.
Furthermore, state-backed threat actors have targeted key governmental bodies, financial institutions, and domestic media outlets.
Key Technical Upgrades
Over the observed two-year timeline, UAC-0099 systematically overhauled MATCHBOIL across several key vectors:
- Advanced Obfuscation: Moving away from basic string encryption and unprintable Unicode characters to industrial-grade obfuscators like Eziriz .NET Reactor, which features control-flow obfuscation and code virtualization.
- Sandbox Evasion: Introducing environment checks designed to detect automated analysis environments, virtual machines, and sandboxes, allowing the malware to sleep or alter its behavior to remain hidden.
- Execution Architecture: Evolving from a simple "one-shot" downloader into a persistent, timed daemon capable of periodically polling C2 servers for updated payloads.
- Decoy Interfaces: Experimenting with graphical user interfaces (GUIs)—ranging from a flawed daily planner application to a functional regex text-search utility—to mask unauthorized execution if manually triggered by victims or analysts.
Chronology of Development
The lifecycle of MATCHBOIL provides a rare, granular window into how threat groups iteratively develop, test, and deploy operational tooling over extended periods. ESET’s timeline maps the weaponization process from early blueprints to modern deployments observed as recently as June 2026.
April 2024 – August 2025: The Genesis and Early Iterations
While Ukraine’s Computer Emergency Response Team (CERT-UA) officially documented MATCHBOIL for the first time in August 2025, ESET’s telemetry uncovered older, previously uncataloged samples dating back to April 2024.
During this foundational phase, MATCHBOIL was relatively rudimentary. It operated primarily as a one-shot downloader—meaning it executed once, fetched a secondary payload, and terminated. To establish persistence on compromised endpoints, these early variants relied on a combination of Windows Registry Run keys and scheduled tasks. Obfuscation techniques were basic, relying heavily on unprintable Unicode characters and elementary string encryption to deter casual human analysis.
July – Late 2025: Architectural Shifts and Evasion Tactics
By the middle of 2025, the malware began to undergo a rapid architectural transformation. A July 2025 sample streamlined its persistence methods, temporarily stripping out scheduled tasks and relying solely on Registry Run key entries.
However, by late 2025, UAC-0099 implemented dramatic changes:
- Timer-Based Execution: The malware abandoned its one-shot model, introducing a two-minute timer loop. This allowed the downloader to continuously poll its C2 infrastructure for updated instructions and fresh payloads over time.
- Commercial Obfuscation: The threat actors abandoned home-grown string obfuscation in favor of the commercial Eziriz .NET Reactor tool. This introduced control-flow obfuscation and code virtualization, severely complicating reverse-engineering efforts.
- Sandbox Checks: The first rudimentary sandbox-detection routines were integrated during this period, signaling an increased operational security (OPSEC) posture by the developers to avoid automated behavioral analysis.
- The Daily Planner Decoy: Late-2025 variants introduced a graphical user interface styled as a daily planner, which popped up if the malware was executed manually. Researchers, however, noted several logical inconsistencies and UI bugs that detracted from its credibility as a legitimate application.
Early 2026 – June 2026: Refinement and Operational Deployment
Entering 2026, the evolution continued at a steady pace. In February 2026, samples dropped the flawed daily planner interface, replacing it with a far more convincing and less conspicuous utility designed to search through text files using regular expressions (regex). This tactical pivot indicated that the operators were learning from previous field deployments and optimizing their lures for human operators who might stumble upon running processes.
By April and June 2026, ESET researchers observed the latest iterations of MATCHBOIL actively deployed across Ukrainian critical infrastructure networks. These versions showcased hardened code virtualization, robust anti-analysis checks, and resilient scheduled-task persistence, proving that UAC-0099 views MATCHBOIL as a long-term, evolving asset rather than a disposable script.
Supporting Data and Technical Analysis
To fully understand the threat posed by UAC-0099, security analysts must examine the technical mechanics underpinning MATCHBOIL’s modular design.
Code Obfuscation and Reverse Engineering Hurdles
The shift to Eziriz .NET Reactor in late 2025 represented a significant hurdle for analysts. .NET applications are notoriously straightforward to decompile back into readable source code using tools like dnSpy or ILSpy. By introducing .NET Reactor, UAC-0099 forced security researchers to spend significantly more cycles de-obfuscating methods, resolving virtualized control flows, and stripping anti-debugging routines before analysis could even begin.
[ Compromised Endpoint ]
│
├──> Executes MATCHBOIL (C# Downloader)
│ │
│ ├──> Runs Sandbox & Environment Checks
│ │ │
│ │ ├── [Sandbox Detected] ──> Terminate / Sleep
│ │ └── [Clean Environment] ──> Proceed
│ │
│ ├──> Establishes Persistence (Registry / Scheduled Tasks)
│ │
│ └──> Opens 2-Minute Timer Loop
│ │
v v
[ Command & Control (C2) Server ] <──> [ Fetches Secondary Payloads ]Persistence and Environment Interactivity
MATCHBOIL’s flexibility in persistence highlights the developers’ adaptability. By toggling between Windows Registry Run keys and Windows Task Scheduler, the malware ensures that even if defenders remediate one persistence vector, secondary mechanisms may remain intact.
Furthermore, the inclusion of decoy interfaces demonstrates an understanding of endpoint visibility. When enterprise security teams or local system administrators investigate running processes or unexpected application windows on an endpoint, a functional text-search utility or a productivity planner is far less likely to immediately trigger suspicion than a headless background console window or an unexplained network connection.
Official Responses and Attribution
ESET has attributed the MATCHBOIL campaign with medium confidence to UAC-0099, a cyber espionage collective known in the threat intelligence community for operating primarily in alignment with Russian strategic interests. While state-sponsored attribution is notoriously complex—often relying on a mosaic of infrastructure overlaps, code reuse, victimology, and geopolitical timing—independent researchers and governmental CERTs have closely monitored the group’s trajectory.
The Role of CERT-UA
Ukraine’s Computer Emergency Response Team (CERT-UA) has played a pivotal role in tracking and unmasking campaigns orchestrated by UAC-0099 and allied threat actors. By publicly releasing technical indicators of compromise (IOCs) and baseline intelligence reports—such as their initial August 2025 documentation of MATCHBOIL—CERT-UA has enabled domestic and international defenders to rapidly patch vulnerabilities and sweep networks for unauthorized downloads.
Industry Collaboration
Major cybersecurity vendors have emphasized the importance of cross-border intelligence sharing in mitigating threats from groups like UAC-0099. The ability to connect an uncataloged sample from April 2024 with sophisticated iterations observed in June 2026 relies entirely on expansive telemetry networks and collaborative threat-hunting frameworks. Security agencies continue to urge organizations, particularly those operating within allied nations and critical sectors, to adopt zero-trust architectures and monitor closely for anomalous C# utility executions.
Implications for Global Cybersecurity and Critical Infrastructure
The continuous refinement of MATCHBOIL carries profound implications that extend far beyond the immediate theater of the Russia-Ukraine conflict.
1. The Industrialization of Custom Tooling
State-sponsored cyber espionage groups are increasingly adopting commercial software protections—such as advanced packers, commercial obfuscators, and virtualized execution environments—traditionally associated with cybercrime syndicates (e.g., ransomware operators). This convergence means that nation-state toolkits are becoming harder to distinguish from financial malware at the binary level, complicating automated detection and triage for Security Operations Center (SOC) analysts.
2. Resilience of Critical National Infrastructure (CNI)
The targeting of transportation, manufacturing, and energy sectors in Ukraine serves as a live-fire laboratory for modern cyber warfare. Adversaries are testing how deep they can penetrate operational technology (OT) and IT boundaries using seemingly standard downloaders like MATCHBOIL. The lessons learned by these threat actors in the wild could potentially be adapted and weaponized against critical infrastructure in Western nations and NATO allies in future geopolitical confrontations.
3. The Shift Toward Persistent, Modular Espionage
The transition from one-shot downloaders to timed, looping daemons reflects a broader strategic shift in cyber espionage. Rather than executing a noisy, smash-and-grab data theft operation, modern threat actors prefer maintaining a quiet, highly resilient foothold. By utilizing modular downloaders like MATCHBOIL, attackers can dynamically deploy task-specific payloads—ranging from credential harvesters to internal reconnaissance tools—only when needed, drastically reducing their operational footprint.
Conclusion
ESET’s deep-dive documentation of MATCHBOIL’s two-year evolution serves as a stark reminder of the patience and engineering discipline exhibited by modern state-sponsored threat groups. As UAC-0099 continues to refine its codebase, evade security controls, and target vital infrastructure, the cybersecurity community faces an ongoing imperative: to match the agility of threat actors through continuous monitoring, rigorous threat intelligence sharing, and proactive defense-in-depth strategies.
