/
← Voltar ao feed
medium

UAC-0099 embeds decoy nuclear-weapon request in VBScript to trip LLM scanner guardrails ahead of MATCHBOIL loader (GuardBreaker)

1 fonte(s) · 1 atualização(ões) · publicado 10/09/2026 06:00 · coletado há 4 dias

ESET researchers observed the Russia-aligned group UAC-0099 embedding a decoy request for guidance on building a nuclear weapon in a comment inside a VBScript used in the early stages of an attack on a target in Ukraine. The comment was meant to trigger the safety guardrails of an LLM-powered code scanner so that it stops inspecting the file before reaching the malicious code. ESET named the technique GuardBreaker, a very simple form of prompt injection. The script's purpose was to download and install MATCHBOIL, a loader used exclusively by this group to deliver additional payloads. The comment does not affect runtime behavior, which suggests UAC-0099 was accounting for AI-assisted analysis in the target's defenses.

Detalhes técnicos

  • GuardBreaker exploits the lack of reliable boundaries between untrusted content and trusted instructions in current LLMs; the adversarial input reaches the model at inference time via the file being analyzed.
  • In other recent attacks, UAC-0099 also checked for processes associated with analysis tools such as IDA and Wireshark.
  • Similar LLM-scanner interference was seen in software supply-chain attacks: Socket found fabricated system instructions and policy-triggering content ahead of a JavaScript payload in malicious PyPI packages, and StepSecurity found a prompt instructing analyzing models to ignore the malicious code and report the package as clean. An npm package repeated "You're absolutely right!" tens of thousands of times to exhaust the model's context window.
  • Other plausible evasion ideas the article lists: files that get truncated or partially parsed, malicious code disguised as confidential data, custom file types, steering AI agents toward actions needing human review, and hijacking agent calls to external tools such as unpackers or deobfuscators.

Remediação

  • Know what each LLM-powered tool inspects, where it sits in the decision chain, and what happens when it refuses to respond or cannot complete a task.
  • Never let a single LLM engine decide that code is safe; cross-validate with a multi-layered, multi-model approach combined with human expertise.
  • Treat a lack of output from an AI tool as a trigger for further checks.
  • Organizations without 24/7 security teams can use managed detection and response (MDR) for investigation and follow-through.

Linha do tempo

  1. welivesecurity.com ↗ · pub. 10/09/2026 06:00 · coletado 19/10 18:00 primeiro registro

    UAC-0099 embeds decoy nuclear-weapon request in VBScript to trip LLM scanner guardrails ahead of MATCHBOIL loader (GuardBreaker)

    ler a análise desta fonte

    ESET researchers observed the Russia-aligned group UAC-0099 embedding a decoy request for guidance on building a nuclear weapon in a comment inside a VBScript used in the early stages of an attack on a target in Ukraine. The comment was meant to trigger the safety guardrails of an LLM-powered code scanner so that it stops inspecting the file before reaching the malicious code. ESET named the technique GuardBreaker, a very simple form of prompt injection. The script's purpose was to download and install MATCHBOIL, a loader used exclusively by this group to deliver additional payloads. The comment does not affect runtime behavior, which suggests UAC-0099 was accounting for AI-assisted analysis in the target's defenses.

    Technical Details

    • GuardBreaker exploits the lack of reliable boundaries between untrusted content and trusted instructions in current LLMs; the adversarial input reaches the model at inference time via the file being analyzed.
    • In other recent attacks, UAC-0099 also checked for processes associated with analysis tools such as IDA and Wireshark.
    • Similar LLM-scanner interference was seen in software supply-chain attacks: Socket found fabricated system instructions and policy-triggering content ahead of a JavaScript payload in malicious PyPI packages, and StepSecurity found a prompt instructing analyzing models to ignore the malicious code and report the package as clean. An npm package repeated "You're absolutely right!" tens of thousands of times to exhaust the model's context window.
    • Other plausible evasion ideas the article lists: files that get truncated or partially parsed, malicious code disguised as confidential data, custom file types, steering AI agents toward actions needing human review, and hijacking agent calls to external tools such as unpackers or deobfuscators.

    Remediation

    • Know what each LLM-powered tool inspects, where it sits in the decision chain, and what happens when it refuses to respond or cannot complete a task.
    • Never let a single LLM engine decide that code is safe; cross-validate with a multi-layered, multi-model approach combined with human expertise.
    • Treat a lack of output from an AI tool as a trigger for further checks.
    • Organizations without 24/7 security teams can use managed detection and response (MDR) for investigation and follow-through.