MATCHBOIL: New tricks, same old evil intentions

1. Executive summary

ESET Research has published a chronological analysis of MATCHBOIL, a custom C# downloader used by the Russia-aligned group UAC-0099 to retrieve, install, and persist a second-stage payload. The downloader has been in development since at least April 2024, with the most recent analysed sample compiled in April 2026, and has moved from Unicode symbol renaming to the Eziriz .NET Reactor obfuscator while adding sandbox-evasion checks. All victims observed in ESET telemetry were in Ukraine, across transportation, manufacturing, and energy, so there is no evidence of EMEA financial services targeting in this reporting. The direct risk to our clients is low on current evidence; the material risk is supply-chain and third-party exposure for firms with Ukrainian operations or counterparties, and the fact that UAC-0099 has acted as an initial access broker for Sandworm. No CVE is referenced in this item and no CISA KEV entry applies.

2. Regulatory framing

No DORA incident-reporting article is engaged by this item as written: ESET reports no incident at an EMEA financial services client, and the reporting describes malware development and Ukrainian victims only. If a client identifies MATCHBOIL on its own estate, DORA Art. 17, 18, and 19 and NIS2 Art. 23 become engaged at that point, and the classification and reporting clocks start then.

3. Technical analysis & attack chain

MATCHBOIL is a C# downloader. Its function is narrow: retrieve a payload from its command-and-control server, install it, and establish persistence for it. ESET's analysis covers samples compiled between April 2024 and April 2026, and the direction of travel across that window is toward more obfuscation and more environment checks.

Confirmed steps in the delivery chain, as described by ESET:

1. A spearphishing email carries a malicious link.
2. The recipient clicks the link, which downloads an archive file.
3. The archive contains a VBScript file.
4. The VBScript downloads and executes MATCHBOIL on the victim machine.
5. MATCHBOIL contacts its C&C server, downloads a second-stage payload, installs it, and establishes its persistence.

ESET's public summary truncates at the point where it would describe the archive and VBScript mechanics in more detail, so the archive format, the VBScript filename, and the exact persistence mechanism MATCHBOIL uses are not in the material available to us. Do not assume a specific persistence location or registry key from this advisory.

Code evolution. The earliest analysed versions, from April 2024, used Unicode symbol renaming for obfuscation. Later versions use the Eziriz .NET Reactor obfuscator. ESET describes the pre-November 2025 samples as "much more straightforward and simple to analyze" than the newer ones, which is a direct statement that the obfuscation and anti-analysis work increased over the period. Sandbox-detection techniques were added incrementally across the versions rather than appearing in one release.

Timeline and discovery. ESET's investigation began in February 2026 after two MATCHBOIL samples were uploaded to VirusTotal. Both samples communicated with a domain previously attributed to UAC-0099, which is what prompted the deeper look. ESET telemetry then surfaced samples with similar behaviour from November and December 2025, and older samples compiled in April 2024 that were seen in telemetry in July and August 2025. CERT-UA first documented MATCHBOIL publicly in August 2025, but the compilation timestamps on those CERT-UA samples indicate they were built in mid-2024, which is why ESET assesses development began around April 2024 rather than 2025.

Victimology. Every MATCHBOIL victim ESET observed in its telemetry was in Ukraine. The sector breakdown over time: multiple transportation companies in July and August 2025, a manufacturing company in December 2025, and an energy-sector company in June 2026. The two February 2026 VirusTotal samples were also uploaded from Ukraine. This is a single-vendor telemetry picture and reflects ESET's visibility only; it does not establish that victims exist nowhere else.

Attribution and confidence. UAC-0099 is described by ESET as a cyberespionage group targeting government organisations, financial institutions, and media, all in Ukraine, active since at least 2022 and first reported by CERT-UA in June 2023. ESET states medium confidence that the group is aligned with Russian interests, based on targeting. UAC-0099 can act as an initial access broker for Sandworm. There is no MITRE ATT&CK profile for UAC-0099 in our reference data, so we treat the attribution as unconfirmed and the Russia-alignment as a medium-confidence vendor assessment, not an established fact. The group also deploys LONEPAGE, a PowerShell downloader named for the word "page" in its C&C URLs.

Single-source caveat: everything in this section comes from one ESET Research publication. The sample set, the compilation timestamps, the victim sectors, and the obfuscator identification are ESET's findings and have not been independently corroborated in the material provided. Treat the technical detail as reliable for detection engineering but verify before acting on any specific indicator.

4. Mitigation & containment

P1 within 24 hours

• If your estate has Ukrainian operations, subsidiaries, or a supplier with Ukrainian infrastructure, search EDR and proxy telemetry for the delivery pattern: an email link leading to an archive download followed by VBScript execution. The VBScript-to-downloader handoff is the highest-value detection point because it is the step MATCHBOIL cannot avoid.
• Block execution of VBScript from user-writable directories and from archive-extracted paths. If your environment does not need Windows Script Host, disable it (wscript.exe, cscript.exe) via AppLocker or WDAC. This breaks step 4 of the chain regardless of which MATCHBOIL version is in use.
• Alert on outbound HTTP or HTTPS from wscript.exe or cscript.exe child processes. A script interpreter making a network connection is the behaviour that matters here, and it is version-independent.

P2 within 72 hours

• Review third-party and supply-chain exposure for any provider with Ukrainian operations, per the DORA Art. 28 and NIS2 Art. 21(2)(d) rows above. Ask specifically whether the provider has seen the archive-plus-VBScript delivery pattern.
• Add the .NET Reactor obfuscator to your malware-triage notes. A C# binary that is .NET Reactor packed and makes a network connection on first run is worth escalating, because that combination now matches MATCHBOIL's current build.
• Where you have .NET assembly inspection capability, check for Unicode-heavy symbol names in older samples and .NET Reactor stubs in newer ones. Both are visible without executing the sample.

P3 within 7 days

• Confirm that spearphishing controls quarantine archive attachments containing script files, and that link rewriting resolves and inspects the final download rather than only the initial URL.
• If you hold Ukrainian government, media, or financial-sector relationships, treat UAC-0099 as a named actor in your threat model given its role as an access broker for Sandworm. The destructive-attack follow-on is the reason to care about a downloader that is otherwise unremarkable.

No vendor patch exists for this item. MATCHBOIL is malware, not a vulnerable product, so there is no version to pin and no CVE to remediate. The controls above are the remediation.

5. Indicators of compromise

No atomic indicators of compromise are available in the source material. ESET's public summary does not publish file hashes, C&C domains, IP addresses, or file paths for MATCHBOIL, and we will not fabricate them. The one domain referenced is described only as "a domain previously attributed to UAC-0099" and is not named in the material available to us.

The sources do describe observable behaviours. Those are set out below.

Behavioural indicators

Behaviours are not included in the copyable block below. That block is reserved for machine-pivotable atomic indicators, and there are none.

6. Detection

The sources give usable behavioural material but no distinctive strings, filenames, mutexes, registry keys, or command-line flags for MATCHBOIL itself. ESET's summary does not publish the VBScript filename, the archive name, the C&C domain, or any hard-coded value from the samples. A YARA rule built from what is available would have to key on generic .NET Reactor characteristics or on the actor and malware names, and a rule that greps for "MATCHBOIL" or "UAC-0099" detects reporting about the threat, not the threat. We are not emitting that rule.

A Sigma rule is possible, because the delivery chain has a log-visible step: a script interpreter making a network connection. That behaviour is not unique to MATCHBOIL, so treat the rule as a hunting query with a triage burden, not a high-fidelity alert.

title: Script interpreter initiating outbound network connection
id: 7f3c1a92-4b6e-4d21-9c88-2a5e0d1b7c44
status: experimental
description: Detects wscript.exe or cscript.exe spawning a network connection, consistent with the MATCHBOIL delivery chain where a VBScript downloads and executes the downloader. Low fidelity on its own; triage against expected script activity.
author: Adverse Trace
date: 2026-10-09
references:

  - https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/
logsource:
  category: network_connection
  product: windows
detection:
  selection_image:
    Image|endswith:

      - '\wscript.exe'
      - '\cscript.exe'
  selection_connection:
    Initiated: 'true'
  condition: selection_image and selection_connection
falsepositives:

  - Legitimate logon scripts and software deployment scripts that call network resources
  - Inventory and management tooling that uses Windows Script Host
level: low
tags:

  - attack.execution
  - attack.command_and_control

Insufficient distinctive artefacts were available to author a YARA rule for MATCHBOIL.

7. Sources

• ESET Research (welivesecurity.com), "MATCHBOIL: New tricks, same old evil intentions", https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/, published 2026-10-08.

This is the only source provided for this item. Every technical claim in this advisory traces to it.

8. Adverse Trace position

Adverse Trace assesses the direct risk to EMEA financial services clients from this item as low. The reporting describes malware development and Ukrainian victims, with no observed targeting of our client base, and there is no CVE, no CISA KEV entry, and no exploitation state to act on. The attribution to UAC-0099 and the medium-confidence Russia-alignment assessment are ESET's, and with no MITRE ATT&CK profile for the actor in our reference data we hold that attribution as unconfirmed. The reason this advisory exists at all is the access-broker relationship with Sandworm and the Ukrainian third-party exposure that some of our clients carry, which is why the regulatory framing points at DORA Art. 28 and NIS2 Art. 21(2)(d) rather than at incident reporting. We will monitor for published MATCHBOIL indicators, since ESET's summary does not include them and a follow-up publication or CERT-UA update may; if atomic indicators appear, we will issue a revision with detection content. Clients with Ukrainian operations or suppliers should treat the P1 items in section 4 as the immediate action and report back if the archive-plus-VBScript pattern appears in their telemetry.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.