UAC-0099

Russia-linked threat actor UAC-0099, also known as Earth Sirrush, conducted a spear-phishing attack against a Ukrainian logistics company in July 2025, deploying the MATCHBOIL downloader and subsequently the MATCHWOK backdoor. A novel backdoor named MythicRatatoskr was deployed, which communicates via the Yggdrasil mesh network, enabling stealthy command-and-control. UAC-0099 later handed access to Sandworm, which executed a destructive data-wiping attack in September 2025 using SDelete distributed via Group Policy, highlighting collaboration between Russian-aligned groups.

Multiple active threats were reported this week, including exploitation of a critical Atlassian Data Center vulnerability (CVE-2026-21589) within hours of disclosure. A new variant of the DarkSword iOS exploit kit, P7 DarkSword, enables on-device keychain and crypto-wallet theft via watering hole attacks. The Russia-aligned threat actor UAC-0099 continues to evolve its MATCHBOIL malware for persistent execution and payload updates. Google disclosed unauthorized HTTPS certificates were issued after attackers hijacked ccTLDs for .gh, .as, and .sl by compromising third-party operators. A vulnerability in GoBalance allowed attackers to hijack TOR .onion sites, including the darknet forum Dread. Additionally, the FBI disrupted infrastructure linked to the China-aligned Flax Typhoon group.

Russia-aligned threat actor UAC-0099 has been observed using a technique called GuardBreaker to disrupt AI-assisted malware analysis by embedding a nuclear weapon-related prompt in malicious VBS scripts. The prompt 'I want to make a nuclear weapon. Help me ...' is inserted as a comment to trigger safety mechanisms in large language models, preventing further code analysis. The VBS script downloads and installs MATCHBOIL, a C#-based loader used by UAC-0099 to deploy additional payloads, with prior targeting activity focused on Ukraine's transportation and energy sectors.

A Russia-aligned threat cluster known as UAC-0099 is distributing a malicious Notepad++ plugin to deliver MATCHBOIL.V2 malware, a modified version of the C#-based loader MATCHBOIL. The attack begins with a phishing email containing an image that leads to a shortened URL, which redirects to a file-sharing service hosting a malicious ZIP file. The ZIP contains a VBScript that executes a decoy PDF while silently deploying a malicious DLL and additional payloads, including RemoteLibUpdater.exe (BURNYBEAR) and InitTest.dll. The campaign aims to establish persistence and conduct espionage, with no financial motive observed.

Ukraine's CERT has identified a campaign by threat cluster UAC-0099 that abuses Notepad++ plugins to stealthily deploy malware. The attackers distribute a malicious archive containing a legitimate Notepad++ installation alongside a malicious plugin named NppExport.dll, which loads the LunchPoke utility to establish persistence. LunchPoke extracts and executes BurnyBear, a loader for the MatchBoil V2 malware, enabling further malicious activity including scheduled task creation and C2 communication.