RussiaAssessedRussia-alignedEspionageActive 2022 – 2026UAC-0099
Summary
Cyberespionage cluster named and tracked by CERT-UA (first reported June 2023, active since at least 2022) against Ukrainian government bodies, the Defence Forces and defence industry, finance and media. ESET assesses with medium confidence, from its targeting, that it is aligned with Russian interests, and documents it acting as an initial-access broker for Sandworm: it breached a Ukrainian grain-logistics firm on 16 July 2025 and handed it over before Sandworm's 17 September 2025 wipe. Intrusions start with spearphishing links (T1566.002) — "court summons" lures sent from UKR.NET — to archives holding VBScript or HTA droppers the victim must run (T1204.002, T1059.005). These install the C# downloader MATCHBOIL, which fetches the MATCHWOK backdoor or the DRAGSTARE stealer, persisting through scheduled tasks and Run keys (T1053.005, T1547.001). MATCHBOIL gained .NET Reactor obfuscation and sandbox checks from late 2025 (T1027, T1497). From mid-2026 a legitimate Notepad++ 8.8.3 side-loads LUNCHPOKE, which chains to BURNYBEAR and MATCHBOIL.V2 (T1574.001). ESET also saw it plant a decoy request about building a nuclear weapon in a script comment, apparently to trip the guardrails of LLM-based code analysis. C&C runs on BitLaunch VPSs behind Cloudflare with per-domain Let's Encrypt certificates (T1583.003, T1588.004).
Attribution
ESET: aligned with Russian interests (medium confidence, from targeting); CERT-UA names no state
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- ESET Research (Research, 2026-10-08)
Aligned with Russian interests, medium confidence, based on targeting
Campaigns 4
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| Notepad++ side-loading chain — LUNCHPOKE, BURNYBEAR and MATCHBOIL.V2 | 2026-07 | Ukraine | Government | CERT-UA (2026-07-21) — TTP change "from mid-summer 2026" |
| Grain-logistics intrusion handed to Sandworm — MATCHWOK, MythicRatatoskr | 2025-07 – 2025-09 | Ukraine | Agriculture, Transportation | ESET Research (2026-10-22) — access 16 Jul 2025; Sandworm wipe 17 Sep 2025 |
| MATCHBOIL intrusions at Ukrainian transport, manufacturing and energy companies | 2025-07 – 2026-06 | Ukraine | Transportation, Manufacturing, Energy | ESET Research (2026-10-08) — telemetry sightings Jul–Aug 2025, Dec 2025 and Jun 2026 |
| "Court summons" phishing against government, Defence Forces and defence industry — MATCHBOIL, MATCHWOK, DRAGSTARE | 2025 – 2025-08 | Ukraine | Government, Defense | CERT-UA (2025-08-04) — attacks not dated; end is the advisory date |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 10
Malware and tools 7
| Name | Description | Platform |
|---|---|---|
| MATCHBOIL | Downloader | Windows |
| MATCHWOK | Backdoor | Windows |
| DRAGSTARE | Stealer | Windows |
| LONEPAGE | PowerShell downloader | Windows |
| MythicRatatoskr | Backdoor | Windows |
| LUNCHPOKE | Loader | Windows |
| BURNYBEAR | Loader | Windows |
Infrastructure patterns
- C&C on BitLaunch VPSs hidden behind Cloudflare, over HTTP/HTTPS (ESET, 2026)
- Let's Encrypt TLS certificates, never reused across domains (ESET, 2026)
- MythicRatatoskr C&C hosted inside the Yggdrasil encrypted IPv6 mesh network (ESET, 2026)
- Lures sent from UKR.NET, linking to legitimate file-sharing services, often URL-shortened (CERT-UA, 2025)
Reporting and advisories 5
- ESET Research
MATCHBOIL: New tricks, same old evil intentions (Oct 2026) - ESET Research
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration (Oct 2026) - CERT-UA
UAC-0099: LUNCHPOKE, BURNYBEAR, MATCHBOIL.V2 and Notepad++ 8.8.3 (Jul 2026) - CERT-UA
Updated UAC-0099 toolset: MATCHBOIL, MATCHWOK, DRAGSTARE (Aug 2025) - ESET Research
ESET APT Activity Report Q2–Q3 2026 (Oct 2026)