Russian Cyber Group UAC-0099 Revamps MatchBoil Dropper for Stealthy Attacks on Ukraine

A Russian cyber‑espionage outfit identified as UAC-0099 has released a new version of its MatchBoil malware, incorporating a series of stealth enhancements that make the tool harder to spot in network and endpoint defenses. Security analysts say the updated dropper is now being deployed in a sustained campaign aimed at a range of Ukrainian organizations, from government agencies to private‑sector firms.

MatchBoil, first observed several years ago, functions as a lightweight carrier that delivers additional malicious components onto compromised machines. The latest iteration adds layered encryption, dynamic code generation, and a more sophisticated command‑and‑control (C2) handshake, all of which obscure its presence from traditional signature‑based scanners.

Researchers tracking the group note that the new build leverages legitimate‑looking documents and signed Windows binaries to bypass application whitelisting. It also employs file‑less execution techniques, running code directly in memory to avoid leaving artifacts on disk. Anti‑analysis checks have been expanded, allowing the dropper to detect virtualized environments and sandbox tools before activating.

The upgrade comes amid an ongoing cyber conflict between Russia and Ukraine, where state‑aligned actors have repeatedly targeted Ukrainian critical infrastructure, diplomatic channels, and media outlets. By refining MatchBoil, UAC‑0099 appears to be sharpening its toolkit for deeper penetration and longer dwell times within high‑value networks.

Security experts warn that the stealthy nature of the revised dropper could increase the risk of data exfiltration and intelligence gathering, especially if it reaches systems that manage sensitive governmental or industrial data. The obfuscation methods also complicate incident response, as analysts may need to rely on behavioral monitoring rather than static indicators.

Looking ahead, analysts expect further iterations of MatchBoil as the group adapts to defensive measures. Organizations operating in Ukraine are being urged to strengthen endpoint detection and response capabilities, enforce strict application controls, and maintain active threat‑intel sharing with national CERTs to mitigate the evolving threat.