MATCHBOILMATCHBOIL

MATCHBOIL is a C# downloader used by the Russia-aligned group UAC-0099 against Ukrainian targets in the transportation, manufacturing and energy sectors. It was first documented by CERT-UA in August 2025, but ESET found samples compiled as early as April 2024 and versions up to April 2026. It is delivered through spearphishing links leading to an archive with a VBScript that fetches and runs it. It fingerprints the host through WMI (CPUID, BIOS serial number, MAC address) and makes three HTTPS requests to its C2: the first gets a numeric value, the second gets a hex-encoded payload embedded in HTML (usually the MATCHWOK backdoor), and the third gets a configuration file. It then persists the payload through a Run registry value or a scheduled task. Over time it moved from Unicode symbol renaming and custom string encryption to the Eziriz .NET Reactor obfuscator, from a one-shot run to a two-minute polling timer, and added sandbox checks (event ID 6013 uptime, debugger detection, OS install date) and decoy GUIs (a daily planner, a regex search tool). The April 2026 DLL variant loaded by a C# loader is named MATCHBOIL.V2 by CERT-UA. C2 servers are hosted on BitLaunch VPSes behind Cloudflare.