Researchers at ESET have documented almost two years of development of MatchBoil, a downloader that the Russia-aligned espionage group UAC-0099 has used against Ukrainian transportation, manufacturing and energy companies, Help Net Security reported Thursday. Each new version added defenses meant to keep the malware hidden from analysts and security tools.

What Happened

ESET, led in this research by Fernando Tavella, detected MatchBoil at Ukrainian transportation companies in July and August 2025, at a manufacturer in December 2025 and at an energy company in June 2026. The Slovak security firm attributes the activity to UAC-0099 with medium confidence. Neither ESET nor Ukraine's CERT-UA disclosed how many organizations were compromised in total, The Record reported.

The attacks begin with spear-phishing emails carrying a link. The link downloads an archive containing a VBScript file, which in turn fetches and runs MatchBoil. The downloader fingerprints the infected machine using its CPU ID and BIOS serial number, then makes a series of HTTPS requests to its command server. One of the responses carries the next payload hidden as hex-encoded data, which MatchBoil extracts, writes to the local app data folder and keeps running through a scheduled task or a registry entry.

RelatedU.S. Seizes Integrity Tech Hacking Tool Sites as Seven Nations Detail Flax Typhoon Ops

That payload is MatchWok, a C# backdoor that can take screenshots and run PowerShell commands. The Record reported that the group also used an information stealer called Dragstare, which takes browser credentials, cookies and files from the desktop.

How the Malware Evolved

ESET traced MatchBoil's development to at least July 2024, based on compile timestamps. CERT-UA first documented the downloader in August 2025, suggesting it operated for about a year before it was publicly identified.

Later versions show steady changes. Late 2025 builds added a two-minute retry timer, switched to the commercial Eziriz .NET Reactor obfuscator and began checking event logs to detect sandboxes. An April 2026 version added a check that the Windows installation is at least 10 days old, a common way to avoid running inside freshly built analysis machines. The folder where the payload is stored also changed names across versions. ESET said each iteration was more sophisticated than the last, calling MatchBoil an important part of the group's toolkit.

For infrastructure, UAC-0099 rents virtual servers from providers such as BitLaunch, places them behind Cloudflare and uses a separate Let's Encrypt certificate for each domain.

Why It Matters

The victims fit a pattern of Russian-aligned espionage against the companies that keep Ukraine's power and transport networks running, which have also been targets of physical strikes during the war. Access to an energy company's network can give an attacker insight into operations even when the immediate goal is intelligence gathering rather than disruption.

UAC-0099 has been active since at least 2022 and was first publicly reported by CERT-UA in June 2023. It has historically gone after Ukrainian government agencies, financial institutions and media, The Record noted, and in August 2025 it used fake Ukrainian court summonses as phishing lures. Help Net Security reported that ESET says the group previously acted as an initial access broker for Sandworm, the Russian military hacking unit behind past attacks on Ukraine's grid.

What to Watch

ESET has published indicators of compromise that defenders in Ukraine and elsewhere can use to search for MatchBoil, MatchWok and related infrastructure. It remains unclear what data was taken from the energy company or the other victims, and whether access gained through MatchBoil was passed to other Russian groups, as UAC-0099 has done before.