In brief
Researchers detected MATCHBOIL in transport, manufacturing and energy firms, and assess with medium confidence that its operators act in Russian interests.
Cybersecurity company ESET has described improvements to MATCHBOIL, a malware loader used by the UAC-0099 group to target companies in Ukraine, UNIAN reported on October 8.
According to ESET, samples were detected on transport companies' devices in July and August 2025, at a manufacturing company in December 2025 and at an energy company in June 2026. Those dates refer to earlier detections.
ESET researcher Fernando Tavella said the malware spreads through malicious links in targeted phishing emails and can download additional malicious components. He said it had evolved into a tool capable of contacting its command server every two minutes. ESET's research indicates development began at least as early as 2024.
Based on the choice of targets, ESET assesses with medium confidence that UAC-0099 acts in Russian interests. Researchers also suggest it may provide initial access to victims' systems for Sandworm, a group known for destructive attacks in Ukraine; that possible relationship remains an assessment.