MatchBoil Malware Keeps Evolving as Russian-Aligned Spies Target Ukrainian Transport and Energy Firms

A Russian-aligned cyberespionage group known as UAC-0099 has been targeting Ukrainian transportation, manufacturing and energy companies with a malware strain called MatchBoil, according to new research from Slovak security firm ESET. ESET believes the group is likely working in Russia's interests. All MatchBoil infections it has observed were in Ukraine. They were found at several transportation companies between July and August 2025, at a manufacturing company that December and at an energy-sector company in June 2026.

MatchBoil is typically delivered through malicious links in phishing emails. Clicking a link downloads an archive containing files that ultimately run the malware. Once active, it can collect information about the infected computer, download further malicious software from a server controlled by the attackers, and set itself up to stay on the system. Ukraine's CERT-UA first documented it publicly in August 2025, but ESET says development goes back to at least July 2024, with a newer version appearing as recently as April 2026. Over that time the attackers repeatedly made it harder for security software to detect and analyse, improved how it deceives victims, and expanded the information it gathers.

ESET says the pace of change suggests MatchBoil is an important part of the group's toolkit. Not every trick has worked: one variant included a fake daily planner meant to look legitimate, but a typo in its window title made it look like a milk consumption planner. UAC-0099 has been active since at least 2022 and has mainly targeted Ukrainian government, financial and media organisations.