ESET Researchers Trace MATCHBOIL Malware Used by Russia-Aligned Group in Ukraine
Security firm ESET has documented the evolution of MATCHBOIL, a downloader used by the UAC-0099 threat group to install spying backdoors on Windows systems in Ukraine.
Key points
- ESET researchers have tracked nearly two years of development changes to the MATCHBOIL malware.
- The threat actor UAC-0099 uses this downloader to plant secondary spying tools on Windows machines.
- All victims identified in ESET telemetry were located in Ukraine, including energy and transportation sectors.
Security researchers at ESET have published a detailed analysis of MATCHBOIL, a malware downloader linked to the Russia-aligned threat group UAC-0099. The investigation reveals that the group has used this tool to compromise Windows machines in Ukraine, installing secondary spying backdoors to maintain persistent access.
According to Help Net Security, ESET researchers traced almost two years of changes to the MATCHBOIL codebase. The primary function of MATCHBOIL is to act as a downloader, meaning it does not perform the espionage itself but instead plants a second program on the victim’s machine. This secondary program is a spying tool designed to exfiltrate data and monitor user activity. The analysis includes details about the graphical user interface (GUI) displayed during MATCHBOIL’s runtime, providing visual evidence of the malware’s operational state.
Threat Actor and Methodology
The group behind these attacks is identified as UAC-0099, which ESET describes as Russia-aligned. The use of a downloader like MATCHBOIL is a common tactic in advanced persistent threat campaigns, allowing attackers to separate the initial infection vector from the more complex espionage payload. This modular approach can help evade detection, as the initial downloader may appear less suspicious than the final spying tool.
The malware targets Windows operating systems. Once MATCHBOIL executes, it deploys the spying backdoor. The presence of a GUI at runtime suggests the malware may have been developed with testing or configuration interfaces in mind, or it may be designed to mimic legitimate software behavior to avoid raising immediate suspicion among users or automated security tools.
Victims and Target Sectors
Every victim identified in ESET’s telemetry for this specific campaign was located in Ukraine. The attacks targeted critical infrastructure and industrial sectors, highlighting the strategic nature of the intrusion. According to the report, the timeline of compromises includes transportation companies in July and August 2025, a manufacturing entity in December 2025, and an energy company in June 2026.
The focus on energy and transportation sectors aligns with broader geopolitical tensions and previous cyber operations targeting Ukrainian infrastructure. The energy company compromise in mid-2026 indicates that the group has maintained operational capability and continued interest in these high-value targets over a prolonged period. The manufacturing sector inclusion suggests a broader scope beyond just critical utilities, potentially aiming to gather industrial intelligence or disrupt supply chains.
What should you do?
Organizations should monitor for unauthorized network connections and unexpected processes that may indicate the presence of a downloader like MATCHBOIL. Security teams should review logs for signs of secondary payloads being installed after an initial breach. Given the targeting of Windows systems, ensuring that endpoint detection and response (EDR) solutions are updated to recognize known indicators of compromise (IOCs) associated with UAC-0099 is essential. Users should remain vigilant against phishing attempts or other initial access vectors that could deliver the initial malware.
What to do and how to stay safe: MATCHBOIL
- Monitor network traffic for unusual outbound connections that may indicate data exfiltration or command-and-control communication.
- Review system logs for the execution of unknown scripts or processes that occur shortly after a user downloads or opens a file.
- Ensure that Windows machines are patched and that security software is configured to detect and block known malware families.
- Investigate any unexpected GUI windows or processes running in the background that do not correspond to known legitimate applications.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is MATCHBOIL?
MATCHBOIL is a malware downloader used by the Russia-aligned group UAC-0099 to install spying backdoors on Windows machines.
Who has been affected by MATCHBOIL?
According to ESET telemetry, all identified victims were in Ukraine, including transportation, manufacturing, and energy companies.
Is there a fix for MATCHBOIL?
The source material does not mention a specific vendor patch or fix for MATCHBOIL; security professionals should rely on general endpoint protection and monitoring.
