MATCHWOKMATCHWOK

C# backdoor first documented by CERT-UA and described by ESET as used exclusively by UAC-0099. It is the payload most often installed by the MATCHBOIL downloader, which retrieves it hex-encoded inside an HTML response and persists it, for instance through the UpdateMonitor value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run. In the July 2025 intrusion at a Ukrainian grain logistics company reported by ESET, MATCHWOK (C&C uztickets[.]com) was the execution chain that led to the deployment of MythicRatatoskr before access was handed off to Sandworm.