A likely Russia-affiliated cyber-espionage group is using an increasingly sophisticated malware downloader to target Ukrainian organizations across the transportation, manufacturing, and energy sectors.
According to ESET, the group, tracked as UAC-0099, is using the downloader, dubbed MatchBoil, to deliver MatchWok, a C# backdoor that gives the attacker persistent access to compromised systems.
The security vendor's analysis showed that MatchBoil has been in active development since at least 2024, and has kept steadily improving with every iteration since then. Though its core function remains the same — to download additional payloads — the latest edition of the malware features stronger obfuscation, sandbox checks, and evolving persistence mechanisms, researchers warn.
A Constantly Evolving Malware Strain
Overall, MatchBoil has evolved from what ESET terms a "one-shot downloader" into a dropper capable of repeatedly retrieving updated payloads from its command-and-control (C2) server.
"Our investigation of MatchBoil samples from April 2024 to April 2026 revealed multiple modifications, from code-level structure to the use of the .NET Reactor obfuscator, all of these implemented in a relatively short time," ESET said in a technical report this week. "This demonstrates a keen interest by UAC-0099 operators in improving their downloader, not only to avoid detection by security solutions, but also to use it as a key part of their toolset in future attacks."