UAC-0099 evolves MATCHBOIL C# downloader targeting Ukrainian transport, manufacturing and energy firms

Linha do tempo

1. welivesecurity.com ↗ · pub. 08/10/2026 05:45 · coletado 19/10 18:00 primeiro registro

   UAC-0099 evolves MATCHBOIL C# downloader targeting Ukrainian transport, manufacturing and energy firms

   ler a análise desta fonte ocultar

   ESET documented the evolution of MATCHBOIL, a custom C# downloader used by the Russia-aligned cyberespionage group UAC-0099. Samples span April 2024 to April 2026, although CERT-UA first documented the malware in August 2025. Each iteration became more sophisticated, with new obfuscation, sandbox checks and persistence methods. All victims seen in ESET telemetry were in Ukraine: transportation companies (July-August 2025), a manufacturer (December 2025) and an energy company (June 2026). UAC-0099 reportedly can act as an initial access broker for Sandworm.

   Technical Details

   • Delivery: spearphishing emails with links to an archive containing a VBScript. The victim must run the script manually, and it downloads and executes MATCHBOIL.
   • C&C flow: three HTTPS requests. The first returns a numeric value, sent in a custom header on the second request (Count, later Answer). The second returns HTML with a hex-encoded payload, extracted by regex. The third returns a config string saved to a file (config.ini, later config.library-ms). The payload is usually the C# backdoor MATCHWOK. The victim is identified by CPUID, BIOS serial number, MAC address and other host data sent in the SN header.
   • Obfuscation: moved from unprintable Unicode renaming and custom XOR/shift string encryption to Eziriz .NET Reactor.
   • Logic: moved from a one-shot downloader to a two-minute timer that can fetch the latest payload. Some samples keep the C&C logic in AdditionalLib.dll. The April 2026 variant (MATCHBOIL.V2, also described by CERT-UA) is a DLL run by a custom C# loader.
   • Anti-analysis: from late 2025 it checks event ID 6013 for uptime (at least three events of 7,200 seconds or more), with English and Russian regexes, and checks for an attached debugger. The 2026 variant also checks that the OS install date is at least 10 days old.
   • Persistence: changed over time from a Run key plus the scheduled task Updates\CheckTask (2024), to a Run key only (July 2025), to the scheduled task UpdateCheckers\DailyPlanner (late 2025) and the task MailClient\Checker (2026).
   • Masquerading: a decoy GUI (daily planner, later a regex text-search utility). Payload paths changed from %LOCALAPPDATA%\DeviceMonitor, to MeowCheck\MeowMeowProgramm.exe, to SMTPClient\SMTPClientApplication.exe. Mutex: Global\PlannerAssistant.
   • Infrastructure: VPS hosting such as BitLaunch/BL Networks, with Cloudflare used to hide servers and Let's Encrypt certificates that are not reused across domains. UAC-0099 also deploys the PowerShell downloader LONEPAGE.
   • IOCs: C&C domains virtualdailyplanner.pro, telemetry-conf.com, flycloud-service.com (64.95.10.223) and airarticlegenerate.com (64.95.13.210). Sample SHA-1s: F886B615CB9E23EAD2718FF2A61155ACFB04CE9E, 1E2C4AAC30EDFF86CD9A30BD08B199BCD3D0CCCE, C85D28F7D272CE2BBBFB9DAE71D21BF25B8D00FC and 050926727CDD74F0B3A8A098E60B76D10FB06B14.

   Remediation

   • Block and monitor the listed C&C domains and IPs.
   • Hunt for the listed scheduled tasks, Run key values, mutex, directories and filenames.
   • Restrict execution of VBScript and script files delivered in archives from email links.
   • Train users to avoid manually running downloaded scripts.
   • ESET publishes the full IoC list in its GitHub repository.