UAC-0099 refines its MATCHBOIL downloader and uses ASHVEIN RAT

On 8 October 2026 ESET published research on MATCHBOIL, the downloader used by the UAC-0099 group against Ukrainian organisations. According to the researchers, between April 2024 and April 2026 the malware went through several versions, each more sophisticated than the last: stronger obfuscation, sandbox checks, a new execution model and persistence mechanisms that change over time. On the same day The Hacker News reported on a RAT called ASHVEIN, used by the group against Ukrainian government personnel, which hides its commands inside HTML pages.

What happened

UAC-0099 is a cyber-espionage group that has targeted government bodies, financial institutions and media in Ukraine. ESET assesses it as aligned with Russian interests, with medium confidence; Dark Reading, in its headline, speaks directly of “Russian spies”. According to Dark Reading, the group has been steadily refining its main dropper in campaigns against Ukrainian organisations.

MATCHBOIL was first described by CERT-UA, Ukraine’s computer emergency response team, in August 2025. ESET, however, found older samples suggesting that development began as early as April 2024. The researchers observed victims in Ukraine in the transport, manufacturing and energy sectors, with activity recorded as recently as June 2026.

On ASHVEIN, the sources consulted give no technical details so far beyond those mentioned: the type of malware (RAT), the target and the use of HTML to hide commands.

Technical details of MATCHBOIL

MATCHBOIL is a downloader written in C# (.NET): it retrieves the next-stage payloads, installs them and makes them persistent. According to ESET’s analysis, as reported by Infosecurity Magazine, the versions differ in four respects.

Obfuscation. Early versions used unprintable Unicode characters and encrypted strings to make the code harder to read. From late 2025 the group switched to the commercial obfuscator Eziriz .NET Reactor, which can apply code virtualisation and control-flow obfuscation.

Anti-sandbox checks. Also from late 2025, checks to determine whether the program is running in an analysis environment were added gradually. For ESET this signals a deliberate effort against manual analysis and automated inspection.

Execution model. The first samples downloaded the payload only once. A late-2025 version instead stays active on a two-minute timer, so it can fetch a newer payload from the command-and-control server.

Persistence. The mechanism changes over time:

• 2024 samples: a value in the Windows Run registry key combined with a scheduled task;
• July 2025 version: Run key entries only;
• later samples: back to scheduled tasks.

Masquerading. Late-2025 samples, when launched manually, display a graphical interface that imitates a daily planner; ESET noted several inconsistencies that make the disguise unconvincing. A February 2026 sample instead shows a less conspicuous utility for searching text files with regular expressions.

The sources do not state the initial access vector of the most recent campaigns, and the articles consulted do not include indicators of compromise (hashes, domains, addresses).

MITRE ATT&CK (mapping from the reported facts): T1105 (Ingress Tool Transfer), T1547.001 (Registry Run Keys / Startup Folder), T1053.005 (Scheduled Task), T1027 (Obfuscated Files or Information), T1497 (Virtualization/Sandbox Evasion), T1036 (Masquerading).

Impact for European and Italian companies

The sources only mention victims in Ukraine. The case still matters to European companies for two reasons. First, the sectors hit (transport, manufacturing, energy) are the same ones the NIS2 directive classes as essential or important: organisations in these sectors with sites, suppliers or customers in Ukraine have one more reason to check their systems. Second, the techniques described (a .NET downloader protected by a commercial obfuscator, anti-sandbox checks, persistence via Run keys and scheduled tasks) are common and should be covered by endpoint detection, whoever the attacker is.

ESET concludes that the UAC-0099 operators want to improve the downloader not only to evade security products, but also to use it as a key part of their toolset in future attacks.

What to do now

1. Check persistence on Windows workstations: look for recently created scheduled tasks and Run key values that launch unsigned .NET executables, especially from user-writable folders.
2. Look for periodic connections: a process contacting the same external server at regular intervals of about two minutes deserves a closer look.
3. Handle protected .NET binaries with care: an executable protected with .NET Reactor is not necessarily malicious, but an unknown one that has just arrived by email or download should be analysed.
4. Restrict execution from user folders with Windows application control policies, where feasible.
5. Check the indicators: for hashes and domains, refer to ESET’s original research and to CERT-UA advisories, and search for them in your logs from recent months.
6. If you work with Ukrainian organisations in the sectors mentioned, raise your level of scrutiny on attachments and programs received through those channels.

How ARXDOME helps

ARX Sentry collects logs, security events, inventory and file changes from computers and servers and brings them into the SOC pages, where new scheduled tasks and suspicious processes become visible. ARX Shield shows the protection status of every machine and lets you isolate a suspicious workstation from the network. ARX Horizon enriches every event with country, network operator and threat lists, which help you assess the destinations of outbound connections.

Last updated: 8 October 2026