Executive Summary

In a two-year investigation, ESET researchers have tracked the persistent evolution of MATCHBOIL, a sophisticated C# downloader utilized by the Russia-aligned advanced persistent threat (APT) group known as UAC-0099. While initially brought to public attention by Ukraine’s Computer Emergency Response Team (CERT-UA) in August 2025, retrospective analysis indicates that the malware has been under active development since early 2024.

MATCHBOIL serves as the foundational "first-stage" weapon in UAC-0099’s arsenal. Its primary function is to establish a foothold on victim machines, facilitate the retrieval of secondary payloads from a command-and-control (C&C) server, and ensure long-term persistence within targeted networks. Targeted primarily at Ukrainian organizations—spanning government, financial, media, manufacturing, and energy sectors—the malware has undergone significant architectural shifts, moving from rudimentary obfuscation to advanced .NET-based virtualization, reflecting a threat actor that is continuously refining its craft to evade modern security solutions.

The Chronology of a Cyber-Weapon

The lifecycle of MATCHBOIL provides a window into the operational maturity of UAC-0099. By analyzing samples compiled between April 2024 and April 2026, researchers have mapped the group’s transition from simple, one-shot downloaders to complex, multi-stage modular tools.

Phase 1: The 2024 Foundation

The earliest identified iterations of MATCHBOIL utilized basic obfuscation techniques, relying on unprintable Unicode symbols (e.g., uFDD1.uFDD0) to mask class and method names. These versions employed a custom XOR-based string decryption algorithm, with the specific seed changing per sample to frustrate static analysis.

During this period, the downloader was a "one-shot" utility. Upon execution, it would perform a series of WMI queries—capturing CPUID, BIOS serial numbers, and machine identifiers—to fingerprint the host. If the system was deemed valid, it executed three distinct HTTPS requests to the C&C server. The first request established identity, the second fetched a hex-encoded payload (typically the MATCHWOK backdoor), and the third retrieved configuration data. Persistence was achieved via standard Windows Registry Run keys and scheduled tasks, such as UpdatesCheckTask.

Phase 2: The July 2025 Refinement

By mid-2025, the group introduced asynchronous tasking using the .NET Task library. This allowed for better process flow management, ensuring that dependencies were met before moving to subsequent stages of the infection chain. This version also expanded the scope of data exfiltration during the initial handshake, adding network interface MAC addresses and hardware manufacturer details to the victim’s profile. Notably, the group began utilizing the Win32_Process object for more direct execution of payloads post-installation.

Phase 3: The Late 2025 Complexity Spike

The samples discovered in November and December 2025 marked a paradigm shift in UAC-0099’s operational security. Moving away from manual obfuscation, the group adopted the commercial Eziriz .NET Reactor obfuscator. This introduced code virtualization and advanced control-flow obfuscation, rendering traditional decompilation far more difficult.

To deceive victims who might trigger the malware manually, the group added a GUI-based "daily planner." Despite the humorous attempt at misdirection—including a typo implying the program was for "milk product intake"—the UI served to hide the background execution of the malicious routine. This iteration introduced sandbox evasion, utilizing the EventLogReader class to query system uptime. If the machine had not been booted for at least two hours (suggesting a real, non-sandbox environment), the malware would proceed. Furthermore, the malware was upgraded to maintain ongoing communication with the C&C server via a timer, transforming the tool from a one-shot downloader into a persistent communication node.

Phase 4: The 2026 Evolution

In 2026, the malware became increasingly modular. Recent variants have shifted from EXE-based execution to DLL-based loaders. The April 2026 variant, designated by CERT-UA as MATCHBOIL.V2, added a "time-to-live" check, refusing to execute if the operating system had been installed less than ten days prior—a clear attempt to avoid fresh analysis snapshots. The file structure became more disciplined, with payloads now masquerading as legitimate system tools, such as SMTPClientApplication.exe.

Supporting Data: UAC-0099’s Infrastructure

UAC-0099’s infrastructure strategy is characterized by a "low-and-slow" approach to domain management and a high reliance on anonymity services.

• Hosting: The group consistently leverages Virtual Private Servers (VPS) from providers like BitLaunch to house their command servers.
• Anonymization: To mask the true location of these servers, they employ Cloudflare as a reverse proxy.
• Security Certificates: The operators utilize Let’s Encrypt for their TLS certificates. Crucially, they appear to practice strict certificate isolation, ensuring that certificates are never reused across different C&C domains, thereby minimizing the risk of cross-linking their infrastructure if one domain is burned.

Official Responses and Threat Intelligence

The persistence of UAC-0099 has drawn the attention of international cybersecurity bodies. CERT-UA, which first reported the group in 2023, continues to monitor these developments closely. The group’s role as an "Initial Access Broker" for more destructive entities—such as the infamous Sandworm group—highlights the strategic danger they pose. By providing a bridgehead into sensitive Ukrainian networks, UAC-0099 acts as a crucial enabler for broader, potentially more devastating operations.

ESET Research continues to provide telemetry and analysis to stakeholders, emphasizing that while the intent of MATCHBOIL remains the same, the methodology is becoming increasingly indistinguishable from legitimate enterprise software management tools.

Implications for Defenders

The evolution of MATCHBOIL carries significant implications for organizations operating in high-risk regions:

1. Endpoint Detection and Response (EDR) Gaps: Because UAC-0099 uses legitimate Windows management classes (WMI, scheduled tasks, registry keys) for their malicious operations, traditional signature-based antivirus solutions often fail. Defenders must look for behavioral anomalies, such as unexpected child processes spawned by obscure C# binaries.
2. The Human Element: The introduction of "decoy" GUIs underscores the danger of spearphishing. Employees must be trained to treat even professional-looking "productivity tools" with suspicion if they originate from unsolicited emails.
3. Infrastructure Hunting: Security teams should monitor for the specific patterns of MATCHBOIL’s network behavior, such as the use of custom HTTP headers like SN and Answer, and the distinctive TLS handshake patterns associated with their unique Let’s Encrypt certificate usage.
4. Sandbox Limitations: Because modern malware like MATCHBOIL actively queries system logs and OS installation dates to detect virtualized analysis environments, automated sandboxes must be "hardened" to mimic real-world user activity, including realistic system uptime and long-standing installation histories.

Conclusion

The two-year trajectory of MATCHBOIL is a testament to the persistent and adaptive nature of the UAC-0099 group. By systematically addressing the weaknesses in their own toolset—moving from simple scripts to obfuscated, environment-aware DLLs—they have successfully maintained their utility as a primary infiltration vector against Ukrainian infrastructure.

For cybersecurity defenders, the lesson is clear: the threat is not static. As UAC-0099 continues to experiment with obfuscation and evasion, security operations centers must move beyond static indicators of compromise (IoCs) and focus on behavioral analysis, hunting for the telltale signs of machine-fingerprinting and unauthorized persistence mechanisms. As long as this group remains active, the "MATCHBOIL" downloader will likely continue to evolve, serving as the quiet, persistent key that unlocks the door for more aggressive malicious actors.

Summary of Key Indicators (IoCs)

• Obfuscation: Extensive use of .NET Reactor and custom XOR-shifting.
• Persistence: Scheduled tasks (e.g., DailyPlanner, Checker) and Registry Run keys.
• Communication: HTTPS requests using SN and Answer custom headers.
• Environment Detection: Checking system uptime via Event ID 6013 and OS install dates.

For a full list of SHA-1 hashes and network infrastructure logs, security researchers are encouraged to consult the official ESET GitHub repository for up-to-date threat feeds.