ESET researchers have tracked the development of the MATCHBOIL malware, a custom C# downloader utilized by the Russia-aligned UAC-0099 APT group. This malware is designed to retrieve a payload from the group’s C&C server, install it, and ensure its persistence. While CERT-UA initially reported on MATCHBOIL in August 2025, our research suggests that its development dates back to at least 2024. Our analysis covers versions of the malware ranging from April 2024 to April 2026, detailing the chronological progression and modifications made to MATCHBOIL. Each iteration of the downloader demonstrates increased sophistication, highlighting its significance within UAC-0099’s arsenal.
Key points highlighted in the blogpost:
- MATCHBOIL is a C# downloader employed by the Russia-aligned group UAC-0099 to fetch, install, and maintain another payload.
- The analyzed versions of MATCHBOIL showcase a shift in code obfuscation techniques, transitioning from Unicode symbol renaming to utilizing the Eziriz .NET Reactor obfuscator.
- Over time, various methods to detect sandboxed environments have been integrated into MATCHBOIL.
- Despite CERT-UA’s initial documentation in August 2025, our findings suggest that MATCHBOIL may have been under development since April 2024, based on compilation timestamps of certain samples.
Our exploration of different MATCHBOIL versions commenced in February 2026 upon the discovery of two related malware samples uploaded to VirusTotal. These samples established connections with a domain previously associated with UAC-0099, prompting a deeper investigation. Subsequent analysis revealed additional samples exhibiting similar malicious behavior dating back to November and December 2025. It is believed that all these samples are variants of MATCHBOIL.
Further examination unveiled older samples compiled in April 2024, observed in ESET telemetry in July and August 2025. Compilation timestamps from the first publicly acknowledged MATCHBOIL samples reported by CERT-UA in August 2025 indicate their origin in mid-2024, indicating UAC-0099’s early development of MATCHBOIL.
Through our collection of downloader samples, it is evident that UAC-0099 continues to enhance MATCHBOIL for future operations, with pre-November 2025 samples being notably simpler and easier to analyze compared to newer versions.
All identified MATCHBOIL victims in our telemetry were located in Ukraine across various sectors. From July to August 2025, downloader samples were detected in multiple transportation companies. In December of the same year, they were found in a manufacturing firm. Subsequently, in June 2026, ESET telemetry recorded additional MATCHBOIL samples in an energy sector company.
The two February 2026 VirusTotal samples were also uploaded from Ukraine.
UAC-0099 Overview
UAC-0099 is a cyberespionage group targeting governmental organizations, financial institutions, and media entities primarily in Ukraine. Given its targets, there is moderate confidence that the group aligns with Russian interests. UAC-0099 potentially serves as an initial access facilitator for Sandworm, a Russia-aligned group notorious for destructive attacks in Ukraine.
The group has been active since at least 2022 and was initially disclosed by CERT-UA in June 2023. In addition to MATCHBOIL, the group commonly deploys LONEPAGE, a PowerShell downloader named after the presence of “page” in its C&C URLs.
MATCHBOIL 101
MATCHBOIL is a C# downloader designed to fetch another payload from its C&C server, install it, and ensure its persistence.
The malware is disseminated through malicious links in spearphishing emails. Clicking the link initiates the download of an archive file containing a VBScript payload that executes MATCHBOIL on the victim’s system. It is crucial to note that manual script execution is required for the malicious payload to be activated.
During runtime, MATCHBOIL verifies the existence of a specific directory (with varying names per sample) in %LOCALAPPDATA%. This directory is utilized to install the payload; if the directory already exists, the malware terminates. MATCHBOIL also retrieves basic machine information, such as CPUID and BIOS serial number, to identify the victim during C&C communication.
MATCHBOIL then initiates three HTTPS requests to the C&C server, each serving a distinct purpose:
- The first request retrieves a numeric value from the C&C server, which is utilized in the second request as a header value; the header name varies among samples. This numeric value likely signifies the payload to be downloaded.
- In response to the second request, the C&C server provides code formatted as HTML, containing a hex-encoded payload to be installed on the victim’s machine. MATCHBOIL employs a sample-dependent regular expression pattern to extract and decode the payload. While the regular expressions vary, they often involve HTML tag formats, such as <script>(.*?)</script>.
- The third request retrieves a string from the C&C server, saved into a file in the payload installation directory. This file serves as the payload’s configuration, with the filename varying across samples.
Our analysis indicates that the hex-encoded payload typically consists of a C# backdoor known as MATCHWOK, exclusive to UAC-0099 and initially documented by CERT-UA.
Upon completing communication with the C&C server, MATCHBOIL establishes persistence for the installed payload (a PE file) for future execution. This persistence can be achieved through scheduled tasks or registry modifications in Windows.
Additionally, MATCHBOIL’s own persistence is ensured by the VBScript used to download and install the malware.
Recently, we came across a VBScript sample in ESET telemetry that has been persisting a C# loader to execute MATCHBOIL.
MATCHBOIL’s configuration details are hardcoded within the samples, containing information related to C&C communication, directories, and filenames to be installed on the victim’s machine. Initially, the strings were encrypted in the binary, but the latest sample contains them either in clear text or encrypted due to the obfuscation technique used by the .NET Reactor.
The evolution of MATCHBOIL has been analyzed based on samples spanning from April 2024 to April 2026. Over this period, UAC-0099 made several improvements to the downloader’s code, including changes in logic, obfuscation techniques, persistence mechanisms, defense evasion strategies, and user deception tactics.
The earliest MATCHBOIL samples from 2024 had obfuscated C# class and method names using unprintable Unicode symbols, with strings encrypted using a custom encryption algorithm. These samples retrieved victim machine information using WMI queries and initiated C&C communication to download and install the payload.
In the July 2025 samples, the execution of the code was modified to use asynchronous tasks. Despite some changes, the core functionality of MATCHBOIL remained consistent – downloading and persisting a payload from the C&C server. This implies that the next task will not start until the previous task is completed. For example, when MATCHBOIL sends the first request to the C&C, it will not move on to the second request until the first one is finished.
In contrast to the 2024 samples, this version of MATCHBOIL gathers more information about the victim’s machine, including the serial number of the BIOS, the physical address of the network interface, and the computer’s model and manufacturer, from the SN HTTP header.
For persistence, this time, Windows registry entries in the Run key are used to achieve it.
The significant change in these latest samples of MATCHBOIL is that the malware executes the payload after installation by creating a Win32_Process object through ManagementClass.
The samples from November and December 2025 showcase major changes compared to the July 2025 version. One notable change is the replacement of obfuscation methods with the Eziriz .NET Reactor obfuscator, making the analysis more complex.
Additionally, a GUI in the form of a daily planner is introduced to disguise the malware. The malware expects to be started with the argument -auto to proceed with creating a mutex and installing the payload.
Furthermore, checks are performed to determine if the malware is running in a sandbox or attached to a debugger. It establishes communication with the C&C server and downloads the latest payload, maintaining communication with the server.
The persistence mechanism is altered as well, with the malware creating a scheduled task named UpdateCheckers\DailyPlanner that runs every seven minutes.
In the 2026 samples, several distinct versions of MATCHBOIL have been discovered. In February, a sample (SHA‑1: 1E2C4AAC30EDFF86CD9A30BD08B199BCD3D0CCCE) was discovered with mostly minor changes compared to the previous version. One notable change is the addition of the argument -plans to the check for whether MATCHBOIL should run its malicious code, in addition to the existing argument -auto.
Later in February, another sample (SHA‑1: C85D28F7D272CE2BBBFB9DAE71D21BF25B8D00FC) was found. In this sample, the argument used to execute the malicious activity is -renew. If this argument is missing or different, MATCHBOIL displays a GUI allowing users to search within text files based on regular expressions or user-provided patterns.
The most recent variant discovered in April 2026 (SHA‑1: 050926727CDD74F0B3A8A098E60B76D10FB06B14) is the first MATCHBOIL sample to be a DLL file executed by a custom C# loader. Previous samples were EXE files that sometimes included a DLL containing part of the malware’s logic. This variant has been named MATCHBOIL.V2 by CERT-UA.
This newest variant includes a check to determine if it is running in a virtual environment by comparing the installation date of the operating system to the execution date of the MATCHBOIL sample. If the OS installation date is 10 or more days older, MATCHBOIL terminates.
The malware downloads its payload to %LOCALAPPDATA%\SMTPClient\SMTPClientApplication.exe. It also creates a scheduled task named Checker under a directory named MailClient for persistence. Other logic in MATCHBOIL, such as obtaining information from the victim machine and using regular expressions to obtain the payload and configuration, remains largely unchanged.
UAC-0099 uses virtual private servers from BitLaunch to host its C&C servers and cloud services like Cloudflare to hide them. The servers use HTTP and HTTPS, with TLS certificates generated by Let’s Encrypt and not reused on other domains.
Overall, our investigation of MATCHBOIL samples from April 2024 to April 2026 shows multiple modifications and improvements, indicating a continuous effort by UAC-0099 operators to enhance their downloader for future attacks. Contact threatintel@eset.com for inquiries about our research on WeLiveSecurity. ESET Research also offers private APT intelligence reports and data feeds. If you have any questions about this service, feel free to explore the ESET Threat Intelligence page for more information.
Indicators of Compromise (IoCs)
For a detailed list of indicators of compromise (IoCs) and samples, you can access them on our GitHub repository.
Files
| SHA-1 | Filename | Detection | Description |
| B6569B0050B864C4A0D32326954BC2D3852A3958 | PlannerLibrary.dll | MSIL/Agent.XXC | MATCHBOIL DLL with C&C and payload persistence logic. |
Network
Check out the following network information:
| IP | Domain | Hosting provider | First seen | Details |
| N/A | virtualdailyplanner[.]pro | N/A | 2025‑11‑10 | MATCHBOIL C&C server hidden behind Cloudflare. |
MITRE ATT&CK Techniques
Explore the MITRE ATT&CK techniques based on version 19 of the framework.
| Tactic | ID | Name | Description |
| Resource Development | T1588.002 | Obtain Capabilities: Tool | UAC‑0099 used Eziriz .NET Reactor to obfuscate MATCHBOIL. |
For a more in-depth analysis, visit the 
ESET Threat Intelligence page.
sentence: Please do not forget to turn off the lights before leaving the room. Rewrite the sentence: “The dog ran quickly down the street.”
Rewritten sentence: “The dog sprinted down the street with speed.”
