ESET researchers have documented the evolution of MATCHBOIL, a custom C# downloader used by the Russia-aligned UAC-0099 APT group. The malware downloads a payload from the group’s C&C server, installs it, and establishes persistence.
Although CERT-UA first documented MATCHBOIL in August 2025, ESET Research indicates it has been in development since at least 2024. The earliest versions of the malware that ESET Research analyzed are from April 2024 and the latest are from April 2026; each new iteration of the downloader is more sophisticated than the last. All victims of MACTHBOIL’s cyberespionage that ESET has seen in its telemetry were in Ukraine, across various sectors.
From July to August 2025, ESET saw downloader samples at multiple transportation companies. In December of the same year, they were seen at a manufacturing company. Later, in June 2026, ESET telemetry registered more MATCHBOIL samples, this time at an energy company.
ESET Research’s investigation of MATCHBOIL samples from April 2024 to April 2026 revealed multiple modifications, from code-level structure to the use of the .NET Reactor obfuscator, all implemented in a relatively short time. This demonstrates UAC-0099 operators’ keen interest in improving their downloader not only to avoid detection by security solutions, but also to use it as a key part of their toolset in future attacks.
“The malware is distributed via malicious links in spear phishing emails. Clicking the link downloads an archive file with a VBScript file payload that downloads and executes MATCHBOIL on the victim machine. MATCHBOIL has evolved from a one-shot downloader to one that communicates with the C&C server every two minutes; in late 2025, UAC-0099 added a graphical user interface that appears when the user executes the payload. It changed to a less-conspicuous version in early 2026,” says ESET researcher Fernando Tavella, who analyzed MATCHBOIL.
UAC-0099 uses virtual private servers such as BitLaunch and cloud services such as Cloudflare to host and hide its C&C servers. These servers both use HTTP and HTTPS.
UAC-0099 is a cyberespionage group targeting governmental organizations, financial institutions, and media, all in Ukraine. Based on its targeting, ESET believes, with medium confidence, that the group aligns with Russian interests. ESET believes that UAC-0099 can act as an initial access broker for Sandworm, another Russia-aligned group best known for its destructive attacks in Ukraine.