MATCHBOIL: New Tricks, Same Old Evil Intentions
MATCHBOIL, a C# downloader employed by the Russia-aligned threat actor UAC-0099, has entered a new development phase between April 2024 and April 2026. The latest samples demonstrate a shift from rudimentary Unicode renaming to the commercial Eziriz .NET Reactor obfuscator, coupled with sandbox-detection logic that delays execution in virtualized environments. The changes are designed to bypass both static signature engines and dynamic analysis sandboxes, allowing the downloader to reach a broader set of Ukrainian organizations.
Attack Path and Delivery Mechanism
The delivery vector remains spear-phishing with a malicious link. The link initiates a download of a compressed archive that contains a VBScript file. The script must be executed manually; once run, it downloads the MATCHBOIL binary and launches it. MATCHBOIL then checks for a unique directory under %LOCALAPPDATA%. If the directory exists, the malware exits; otherwise, it proceeds to collect system identifiers such as CPUID and BIOS serial number. These identifiers are sent to the command-and-control (C&C) server to register the victim.
Communication with Command and Control
During execution, MATCHBOIL performs three HTTPS requests to a domain previously attributed to UAC-0099. The first request retrieves a numeric token. The second request includes this token in a custom HTTP header whose name varies per sample, and the third request downloads the secondary payload. The dynamic header naming and token exchange complicate signature-based detection and force defenders to rely on behavioral monitoring.
Evolution of Obfuscation and Sandbox Detection
Early April 2024 samples used simple Unicode renaming to obscure identifiers. By late 2025, samples incorporated the Eziriz .NET Reactor obfuscator, adding layers of control-flow flattening and string encryption. Concurrently, sandbox-detection techniques evolved: newer variants check for virtual machine artifacts, delay execution, and monitor debugger presence. These changes suggest an iterative development cycle aimed at bypassing both static and dynamic analysis.
Victim Profile and Sector Impact
ESET telemetry shows MATCHBOIL activity across multiple Ukrainian sectors. From July to August 2025, transportation companies reported downloads. In December 2025, a manufacturing firm was infected. June 2026 telemetry recorded activity at an energy sector company. All incidents originated from Ukraine, reinforcing the group’s focus on Ukrainian targets.
Defensive Controls and Log Inspection
Defenders should review logs for the following indicators:
- HTTPS requests to known UAC-0099 C&C domains with custom headers.
- Creation of new directories under %LOCALAPPDATA% that match known MATCHBOIL patterns.
- Execution of VBScript files that download and run C# executables.
- Sandbox-detection triggers such as VM registry keys or delayed execution timers.
Endpoint protection solutions should be updated to include signatures for the latest MATCHBOIL binaries and to flag the dynamic header usage. Network firewalls can block outbound traffic to the identified C&C domains.
Mitigation Recommendations
- Deploy application whitelisting to prevent execution of unknown VBScript and C# binaries.
- Enable logging of outbound HTTPS traffic and inspect for custom header patterns.
- Update anti-malware signatures to cover Eziriz .NET Reactor-obfuscated samples.
- Conduct regular sandbox analysis of new samples to identify evolving detection evasion tactics.
Further Reading
For a deeper dive into UAC-0099’s tactics, see the post on Russian Threat Actor UAC-0099 Refines MatchBoil Malware Against Ukrainian Targets.
Related coverage
- How SMB Cybersecurity Complexity Threatens Advanced Protection Goals
- Vercel Patches Critical Next.js ImageResponse RCE Flaw (CVE-2026-94545)
- GlassWorm VS Code Themes and Ransomware Affiliate Betrayal Highlight Weekly Threat Brief