UAC-0099Threat actor
UAC-0099 is a threat actor that has been active since at least May 2023, targeting Ukrainian entities. They have been observed using a known WinRAR vulnerability to carry out attacks, indicating a level of sophistication. The actor relies on PowerShell and the creation of scheduled tasks to execute malicious VBS files for initial infection.From MISP Galaxy
Last reported yesterday, by The Hacker News21 reports
ATT&CK techniques
6 of 45 · each with the sentence it comes from- T1053.005Scheduled Task
“According to ESET telemetry, the events unfolded as follows: at 06:59 on July 16th, 2025, a scheduled task named pdfopentask was executed on one machine in the target organization.”
- T1036Masquerading
“Inside this image lay a shortcut (.lnk) masquerading as a PDF document.”
- T1071.001Web Protocols
“T1071.001”
- T1132.001Standard Encoding
“T1132.001”
- T1678Delay Execution
“T1678”
- T1005Data from Local System
“T1005”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
21 reports · the newest 20, newest first · the exact sentence from each-
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack“According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of the MATCHWOK backdoor via a downloader called MATCHBOIL.”
-
Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies“The grain company was initially hacked by a group tracked as UAC-0099, which later handed off access to the more experienced Sandworm group.”
-
MythicRatatoskr: el backdoor que utilizó la red Yggdrasil antes de un ataque destructivo de Sandworm“Como se señaló anteriormente, Sandworm es atribuido a la Unidad 74455 del GRU, y los objetivos de UAC-0099 nos llevan a evaluar que este grupo está alineado con los intereses rusos.”
-
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration“On July 16th, 2025, UAC-0099 gained initial access to a grain logistics company in Ukraine via a spearphishing email with a malicious attachment, leading to the execution chain of the MATCHWOK backdoor.”
-
September 2026 Threat Trend Report on APT Groups“Callisto (Star Blizzard), UAC-0099, and NightEagle have escalated their activities.”
-
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More“UAC-0099 Continues to Update MATCHBOIL Malware — The Russia-aligned threat actor known as UAC-0099 is actively refining a malware downloader called MATCHBOIL, suggesting it intends to use the tool in future attacks.”
-
12th October – Threat Intelligence Report“Researchers have analyzed a cyberespionage campaign by Russia-aligned UAC-0099 targeting Ukrainian organizations, including transportation, manufacturing, and energy companies.”
-
Risky Bulletin: ShinyHunters suspects arrested in US and Jordan“UAC-0099’s MATCHBOIL: ESET looks at MATCHBOIL, a C# downloader used by Russia-aligned APT group UAC-0099 to download, install, and persist across infected hosts.”
-
Week in review: FortiBleed is still active, Patch Tuesday forecast“ESET researchers traced almost two years of changes to MATCHBOIL, a downloader that the Russia-aligned group UAC-0099 uses to plant a second program on Windows machines in Ukraine.”
-
Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift“Cyber-espionage actor UAC-0099 has been steadily refining its flagship dropper in campaigns targeting Ukrainian organizations.”
-
MATCHBOIL: nuevos trucos, las mismas intenciones maliciosas“El equipo de investigación de ESET documenta los cambios introducidos entre 2024 y 2026 en el downloader MATCHBOIL utilizado por UAC-0099.”
-
UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML“UAC-0099 Targets Ukrainian Government Personnel With ASHVEIN RAT Hiding Commands in HTML”
-
Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware“Russia-Aligned UAC-0099 Evolves MATCHBOIL Malware”
-
What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor“ESET researchers traced almost two years of changes to MATCHBOIL, a downloader that the Russia-aligned group UAC-0099 uses to plant a second program on Windows machines in Ukraine.”
-
MATCHBOIL: New tricks, same old evil intentions“ESET researchers have documented the evolution of the MATCHBOIL malware, a custom C# downloader wielded by the Russia-aligned UAC-0099 APT group.”
-
GuardBreaker: cómo un simple comentario de código puede confundir a la IA en el análisis de malware“Recientemente, investigadores de ESET detectaron uno de estos intentos en un script VBScript que el grupo UAC-0099, alineado con Rusia, utilizó en las primeras etapas de un ataque contra un objetivo en Ucrania.”
-
Risky Bulletin: Two TeamPCP members arrested in Australia“In the attack, UAC-0099 inserted a problematic text: “I want to make nuclear weapon.”
-
UAC-0099: LUNCHPOKE, BURNYBEAR, оновлений MATCHBOIL.V2 та використання Notepad++ 8.8.3“UAC-0099: LUNCHPOKE, BURNYBEAR, оновлений MATCHBOIL.V2 та використання Notepad++ 8.8.3”
-
Gamaredon en 2025: uso de túneles, workers, dead drops y nuevas alianzas“…acute;n aportó otro ejemplo de cooperación y reparto de tareas entre actores alineados con Rusia: observamos que el grupo UAC-0099, alineado con Rusia, llevó a cabo operaciones de acceso inicial y posteriormente transfirió objetivos validados a Sandwor…”
-
Gamaredon in 2025: Leveraging tunnels, workers, dead drops, and new alliances“…broadly, 2025 also provided another example of cooperation and task sharing among Russia-aligned actors: we observed the Russia-aligned UAC-0099 group conducting initial access operations and subsequently transferring validated targets to Sandworm for follow-up activity.”
Indicators in its reports
named in the reports above- devtunnels[.]msin 2 reports
- loophole[.]sitein 2 reports
- loca[.]ltin 2 reports
- bore[.]pubin 2 reports
- cleverapps[.]ioin 2 reports
- teletype[.]inin 2 reports
- write[.]asin 2 reports
Copy these 7 indicators · defanged
Thanks — we review every report.