Russia-Aligned Cyber Espionage Group UAC-0099 Deploys New ASHVEIN Malware in Sophisticated Campaign Against Ukraine

UAC-0099 has also invested heavily in the refinement of its downloader tools, most notably the MATCHBOIL family. According to ESET researcher Fernando Tavella, MATCHBOIL has been under active development since at least April 2024. Its primary role is to serve as a persistent secondary stage, responsible for downloading and installing further payloads onto a compromised system. Recent versions of MATCHBOIL have appeared as DLL files executed by custom C# loaders, and they incorporate advanced environment checks. For instance, the malware may abort execution if it detects it is running in a virtual environment or if the operating system was installed less than ten days prior to the execution—a common sign of a freshly spun-up sandbox used by security researchers.

Perhaps the most innovative and concerning development in UAC-0099’s arsenal is a technique called "GuardBreaker." Observed by ESET in a campaign against a Ukrainian target, this method is specifically designed to undermine artificial intelligence-assisted security analysis. The group deployed a malicious Visual Basic Script (VBScript) that served as a conduit for MATCHBOIL. Within the script’s code, the developers embedded a specific prompt asking for instructions on how to manufacture a nuclear weapon.

This was not a literal request for information, but rather a calculated attempt to trigger the safety and ethical mechanisms of Large Language Models (LLMs). As more security firms integrate AI into their automated analysis pipelines, threat actors are looking for ways to "poison" the data. By including a "forbidden" prompt within the code, the attackers hope to cause an AI analyzer to refuse to process the file entirely, thereby allowing the malicious script to slip through undetected.

The shifting focus of UAC-0099’s targeting provides a grim reflection of the ongoing conflict. While the group initially prioritized government and military organizations, there has been a noticeable drift toward civilian logistics and infrastructure operators. TrendAI notes that this expansion tracks with the logic of the war itself: as the conflict persists, the strategic value of understanding and disrupting Ukraine’s supply lines and civilian networks increases. The cyber effort is now closely following the same objectives as the kinetic one, aiming to destabilize the networks that keep the country supplied and operational.

As the war in Ukraine continues to drive innovation in both offensive and defensive cyber operations, the emergence of ASHVEIN and the group’s use of AI-evasion techniques like GuardBreaker signal a period of increased technical sophistication. Security organizations remain on high alert, as the blurring lines between initial access brokerage and destructive state-sponsored attacks suggest that the threats facing Ukraine’s digital infrastructure are only becoming more complex.