Actor Profile

UAC-0099 is a Russia-aligned threat group active since at least mid-2022. The actor conducts cyber espionage operations primarily targeting Ukrainian entities. UAC-0099 has demonstrated capability in exploiting software vulnerabilities (notably WinRAR flaws) and conducting phishing campaigns to deliver custom malware families including LONEPAGE, MATCHBOIL, MATCHWOK, and DRAGSTARE. The group's operational focus aligns with Russian intelligence collection priorities against Ukraine.

TTPs (Tactics, Techniques, Procedures)

Initial access via phishing emails with image attachments containing obfuscated URLs (T1566.002). Uses link shorteners and file-sharing services (EasySend[.]co) for payload delivery (T1608.001). Employs VBScript masquerading as PDF documents (T1204.002, T1036.007). Leverages DLL side-loading through legitimate Notepad++ 8.8.3 to load malicious NppExport.dll plugin (T1574.002). Establishes persistence via scheduled tasks executing every three minutes (T1053.005). Deploys BURNYBEAR loader to execute MATCHBOIL.V2, a C#-based second-stage loader (T1129). Includes resource exhaustion logic as anti-analysis mechanism when executed without proper arguments. Multi-stage infection chain uses password-protected archives and legitimate binaries (WinRAR, Notepad++) to evade detection (T1027.002).

Targets & Patterns

UAC-0099 primarily targets Ukrainian entities across government and general sectors. The group's targeting pattern reflects Russian intelligence priorities, focusing on Ukrainian organizations for both operational intelligence collection and as a testing ground for TTPs before broader deployment. The use of localized phishing lures and focus on Ukrainian infrastructure indicates the actor conducts tailored operations against specific Ukrainian victims. The campaign's timing (summer 2026) and continued activity suggests sustained intelligence collection requirements against Ukraine.

Historical Context

UAC-0099 has previously weaponized WinRAR vulnerabilities to deliver LONEPAGE malware. The group maintains a consistent malware toolkit including MATCHBOIL (now evolved to MATCHBOIL.V2), MATCHWOK, and DRAGSTARE across multiple campaigns. The current campaign represents an evolution in delivery mechanisms, shifting from direct vulnerability exploitation to sophisticated social engineering combined with DLL side-loading via legitimate software (Notepad++). This tactical adaptation demonstrates the group's operational maturity and ability to diversify initial access methods while maintaining core malware families. The campaign follows established Russian threat actor patterns of testing techniques against Ukrainian targets before broader deployment against Western entities.

Defensive Recommendations

  • Update WinRAR, 7-Zip, and Notepad++ to latest versions to prevent exploitation of known vulnerabilities in software commonly abused by UAC-0099
  • Monitor for suspicious scheduled tasks executing binaries every 3 minutes, particularly those launching executables from non-standard directories (T1053.005 detection via Event ID 4698)
  • Implement DLL side-loading detection by monitoring legitimate applications (Notepad++, other editors) loading unexpected DLLs from user-writable directories (T1574.002)
  • Block or scrutinize VBScript execution from email attachments and downloads, particularly files masquerading as PDFs (T1204.002); consider disabling VBScript via Group Policy
  • Deploy email security controls to detect and block phishing emails with embedded image links to shortened URLs and file-sharing services like EasySend[.]co (T1566.002)

---

# Geopolitical Context

Geopolitical Context

The UAC-0099 campaign reflects Russia's sustained cyber espionage operations against Ukraine, consistent with broader patterns of intelligence collection targeting Ukrainian government and critical infrastructure since the 2022 escalation. The use of sophisticated multi-stage delivery mechanisms—including legitimate software abuse and DLL side-loading—demonstrates continued investment in operational security and evasion techniques. This activity occurs within a wider ecosystem of Russian cyber operations, including concurrent webmail exploitation campaigns by Laundry Bear (targeting Western government entities) and TA458 (Operation RoundPress), suggesting coordinated or parallel intelligence priorities across multiple threat groups. The phishing-based initial access vector and deployment of modular loaders (MATCHBOIL.V2, BURNYBEAR) indicate intelligence collection objectives rather than disruptive intent, aligning with espionage tradecraft typical of Russian state-sponsored actors operating in contested geopolitical theaters.

State Actor Alignment

UAC-0099 is assessed by CERT-UA as Russia-aligned, active since at least mid-2022, and has previously weaponized WinRAR vulnerabilities to deliver espionage malware including LONEPAGE, MATCHBOIL, MATCHWOK, and DRAGSTARE. The group's sustained targeting of Ukrainian entities and use of sophisticated tooling is consistent with Russian intelligence collection priorities. Separately, the U.S. government has attributed parallel webmail exploitation campaigns to Laundry Bear (also known as CL-STA-1114, TA488, Void Blizzard), assessing it as "almost certainly" involved in espionage with Russian government backing based on covert persistence, absence of financial motivation, and prioritization of Ukrainian targets before expansion to NATO allies. Proofpoint tracks related webmail targeting activity as TA458, described as likely a Russian military intelligence operation distinct from APT28, primarily targeting Ukrainian government and Eastern European military entities.

Business Impacty pro region

The campaign's primary impact is on Ukraine, where UAC-0099 continues systematic intelligence collection against government and potentially critical infrastructure targets. The broader pattern of Russian webmail exploitation—evidenced by Laundry Bear's targeting of Western government and commercial organizations since July 2025, and TA458's focus on Eastern European military and government entities across Albania, Greece, Moldova, and Türkiye—indicates expanding operational scope beyond Ukraine. The U.S. government assessment that Ukrainian targeting serves as both a priority objective and a "test bench for malicious cyber techniques before broader global deployment" suggests NATO member states and allied governments face elevated risk from techniques refined in the Ukrainian theater. The exploitation of widely deployed software (Notepad++, WinRAR) and webmail platforms (Zimbra, Roundcube, Kerio, SOGo) creates supply chain and third-party risk for organizations across Europe and allied nations relying on these technologies.

Forecast

If UAC-0099 maintains operational tempo, Ukrainian government and critical sector organizations are likely to face continued phishing and software exploitation attempts using evolving malware variants. Should the pattern observed with webmail campaigns hold—where techniques are tested against Ukrainian targets before broader deployment—NATO member states and Western government entities may encounter similar fake plugin or legitimate software abuse tactics in coming months. If organizations fail to patch known vulnerabilities in WinRAR, 7-Zip, Notepad++, and webmail platforms (Zimbra CVE-2025-66376, Roundcube CVE-2025-49113, SOGo CVE-2026-8496), Russian-aligned actors are likely to continue exploiting these vectors for persistent access. The modular nature of MATCHBOIL.V2 and parallel development of webmail backdoors suggests that if initial access is achieved, adversaries will likely establish multiple persistence mechanisms to ensure long-term intelligence collection even after detection and remediation efforts.