In the landscape of modern cyber-espionage, the distinction between a rudimentary script and a sophisticated, multi-stage malware ecosystem often lies in the persistence of its developers. Recent findings by ESET researchers have brought to light the alarming evolution of MATCHBOIL, a custom C# downloader utilized by the Russia-aligned advanced persistent threat (APT) group known as UAC-0099.
While the malware was first brought to public attention by Ukraine’s CERT-UA in August 2025, retrospective analysis reveals that MATCHBOIL is far from a new phenomenon. It has been under active, iterative development since at least April 2024, serving as a critical entry point for UAC-0099 to infiltrate Ukrainian critical infrastructure, including transportation, manufacturing, and energy sectors.
The Anatomy of an Evolving Threat
MATCHBOIL is a C# downloader engineered with a singular, high-stakes objective: to act as the vanguard for UAC-0099’s malicious operations. Its primary function is to establish a foothold, communicate with a Command and Control (C&C) server, download a secondary payload—typically the MATCHWOK backdoor—and ensure long-term persistence on the victim’s machine.
The distribution vector remains a classic yet effective staple of state-sponsored espionage: spearphishing. Victims are lured into clicking malicious links that trigger the download of an archive file. This archive contains a VBScript, which, if executed by the user, initiates the deployment of the MATCHBOIL downloader. Once active, the malware performs reconnaissance on the host system, gathering hardware identifiers such as CPUID, BIOS serial numbers, and MAC addresses to fingerprint the victim for the C&C server.
Chronology of Development: A Two-Year Retrospective
The evolution of MATCHBOIL from April 2024 to April 2026 offers a masterclass in how threat actors refine their capabilities to evade detection while increasing operational efficiency.
The Foundation (April 2024)
The earliest iterations of MATCHBOIL were relatively straightforward. These versions relied on obfuscation methods using unprintable Unicode symbols and custom string encryption algorithms involving XOR operations and bitwise shifts. At this stage, the malware functioned as a "one-shot" downloader. It utilized WMI queries to harvest system metadata and established persistence through registry Run keys and scheduled tasks.
The Shift to Asynchronicity (July 2025)
By mid-2025, the malware underwent its first significant structural change. Developers integrated the .NET Task library, allowing for asynchronous execution. This change prevented the malware from stalling during C&C communications, making the process more robust. Additionally, the developers expanded the scope of data collection, now capturing computer models and manufacturer information to further refine victim identification.
The Obfuscation Arms Race (Late 2025)
The most drastic pivot occurred between November and December 2025. Abandoning custom obfuscation, UAC-0099 transitioned to the professional-grade Eziriz .NET Reactor. This shift allowed for advanced code virtualization and control flow obfuscation, significantly complicating reverse engineering efforts.
During this period, the group introduced "decoy" behavior. If a user manually executes the file, a GUI—posing as a "daily planner"—appears. This ruse, while slightly marred by poor localization and amusing typos regarding "milk product intake," served to mask the malware’s true background operations. Furthermore, the malware evolved from a one-shot downloader to a persistent beacon, establishing a timer to poll the C&C server every two minutes.
The 2026 Refinements
By 2026, the malware became more modular. The introduction of AdditionalLib.dll separated core logic from the downloader itself. The most recent variants, including those observed in April 2026, exhibit sophisticated sandbox evasion techniques. The malware now queries Windows event logs for system uptime—requiring at least two hours of operation to confirm it is not running in a sterile analysis environment—and checks the OS installation date to avoid short-lived virtual machine environments.
Supporting Data: Infrastructure and Targeting
UAC-0099’s infrastructure strategy reflects a calculated approach to anonymity. The group relies heavily on Virtual Private Servers (VPS) provided by services like BitLaunch, shielded behind Cloudflare proxies. This layer of abstraction makes it difficult for defenders to trace the origin of the attacks. TLS certificates are provisioned via Let’s Encrypt, and notably, the group practices strict operational security by avoiding the reuse of certificates across different domains.
The target profile is consistent with a group serving Russian geopolitical interests. All confirmed victims in ESET’s telemetry were located within Ukraine, spanning vital sectors. The progression from transportation and manufacturing to the energy sector suggests that UAC-0099 is being tasked with higher-value intelligence gathering as its toolset matures.
Implications for Regional Security
The relationship between UAC-0099 and larger, more destructive entities like Sandworm cannot be ignored. UAC-0099 appears to function as an initial access broker. By refining tools like MATCHBOIL, they provide a reliable, stable pipeline for more aggressive groups to deploy ransomware, wipers, or advanced espionage implants.
For Ukrainian organizations, the implications are severe. The shift to DLL-based payloads and the constant rotation of persistence mechanisms (moving between registry keys, scheduled tasks, and specialized loaders) necessitate a multi-layered defense strategy. Relying on simple file-hash signatures is no longer sufficient; security teams must monitor for the behavioral patterns of the malware, such as the unauthorized use of ManagementObjectSearcher or unexpected HTTPS traffic directed at domains with short registration histories.
Official Responses and Defensive Recommendations
While CERT-UA has been instrumental in documenting individual variants, the broader threat community acknowledges the danger posed by this group’s continuous iteration. The primary takeaway for cybersecurity professionals is the need for proactive hunting.
Key Defensive Strategies:
- Behavioral Monitoring: Focus on the detection of WMI queries initiated by non-administrative processes.
- Network Filtering: Restrict traffic to unauthorized VPS providers and monitor for HTTPS headers like
SNorAnswer, which are unique to the MATCHBOIL C&C protocol. - Endpoint Hardening: Regularly audit scheduled tasks and registry Run keys for suspicious entries. The use of specific directory names like
%LOCALAPPDATA%SMTPClientorMeowCheckshould trigger immediate alerts. - Sandbox Analysis: Security analysts should ensure their automated sandboxes are configured to simulate long-term uptime and realistic system history, as the malware’s evasion checks are designed to bypass "clean" or "new" environment setups.
As MATCHBOIL continues to evolve, it remains a testament to the fact that even "small" tools, when backed by a persistent and well-resourced adversary, can pose a significant risk to national and organizational security. The UAC-0099 group has demonstrated that they are not merely "script kiddies" using borrowed tools, but a disciplined unit capable of developing a sophisticated, modular, and resilient malware ecosystem.
For organizations operating in high-risk regions, the time to move beyond reactive security is now. The "Matchboil" project is far from finished, and as the group continues to experiment with new obfuscation techniques and evasion tactics, the gap between initial infection and full-scale compromise continues to shrink. Continued collaboration between private sector researchers and government entities, such as the ongoing work documented by ESET and CERT-UA, remains the most effective way to dismantle these networks before they can do further harm.
For detailed technical indicators of compromise, including specific file hashes and network metadata, security professionals are encouraged to consult the official ESET malware-ioc repository on GitHub.
