ESET Research Tracks MATCHBOIL Downloader Evolution by UAC-0099

ESET Research has published a new analysis detailing the evolution of the MATCHBOIL downloader, a piece of malware attributed to the threat actor UAC-0099. The report catalogs the specific changes and new techniques the group has employed between 2024 and 2026, highlighting a persistent campaign with shifting methodologies.

The research, titled "MATCHBOIL: New tricks, same old evil intentions," focuses on how UAC-0099 has adapted the downloader over a two-year period. According to the first-hand research published by ESET, the group has maintained its core malicious objectives while updating the technical implementation of the software. The analysis serves as a longitudinal study of the threat actor’s operational security and delivery mechanisms, providing insight into how the malware has matured.

Evolution of Tactics

The primary focus of the ESET report is the technical progression of the MATCHBOIL downloader. Rather than a static piece of software, the malware has undergone significant modifications from 2024 to 2026. ESET Research has documented these changes to understand the group’s strategy for evading detection and maintaining access to targeted systems. The title of the report suggests that while the technical "tricks" have changed, the fundamental intent of the malware remains malicious and consistent with previous operations by UAC-0099.

The cataloging of these changes allows security professionals to identify indicators of compromise associated with both older and newer versions of the downloader. By tracking the timeline from 2024 to 2026, ESET provides a comprehensive view of the threat actor’s development cycle. This long-term perspective is critical for understanding how UAC-0099 responds to defensive measures and alters its codebase to remain effective.

Who Is Affected

The MATCHBOIL downloader is associated with the threat actor UAC-0099. While the source material does not specify particular industries or geographic regions targeted during this period, the attribution to a known actor suggests a structured operation. Security teams monitoring for UAC-0099 activity should be aware that the group’s tools have evolved significantly over the last two years.

Organizations that may have been exposed to earlier versions of the malware in 2024 should review their logs for signs of the updated techniques documented in the 2026 analysis. The persistence of the campaign indicates that UAC-0099 continues to actively deploy MATCHBOIL, meaning the threat is current and ongoing.

What should you do?

Security professionals should review the ESET Research publication for specific indicators of compromise related to the MATCHBOIL downloader. Monitoring for the technical changes described in the report can help detect new iterations of the malware.

What to do and how to stay safe: MATCHBOIL

• Review endpoint detection and response logs for behaviors consistent with downloader activity described in recent threat intelligence reports.
• Update threat hunting queries to include indicators associated with the UAC-0099 threat actor and the MATCHBOIL malware family.
• Ensure that software inventory processes are current to identify any unauthorized or unknown executables that may serve as downloaders.
• Monitor for unusual network connections that could indicate communication with command-and-control infrastructure used by known threat actors.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is responsible for the MATCHBOIL downloader?

The MATCHBOIL downloader is attributed to the threat actor known as UAC-0099.

What time period does the ESET analysis cover?

The analysis catalogs changes to the malware from 2024 to 2026.

Has the intent of the malware changed?

According to the report title, the malware has new tricks but maintains the same evil intentions.