Actor Profile

UAC-0099 is a Russia-aligned threat actor with a history of targeting Ukraine's transportation and energy sectors. The group demonstrates tactical innovation by adapting emerging anti-AI analysis techniques to evade detection. UAC-0099 exclusively uses the MATCHBOIL C#-based loader as part of its custom toolset, indicating a degree of operational maturity and tool development capability. The actor's motivation aligns with Russian strategic interests in Ukraine, focusing on critical infrastructure disruption.

TTPs (Tactics, Techniques, Procedures)

UAC-0099 employs the GuardBreaker technique, embedding adversarial prompt injections (nuclear weapon-related text) as comments in malicious VBS scripts to trigger LLM safety mechanisms and prevent AI-assisted analysis. The VBS script serves as an initial access vector to download and install MATCHBOIL, a custom C# loader for second-stage payload delivery. In July 2026, the actor disguised malware as a Notepad++ plugin to compromise Windows systems. These TTPs align with T1027 (Obfuscated Files or Information), T1059.005 (Command and Scripting Interpreter: Visual Basic), T1204.002 (User Execution: Malicious File), and T1036.005 (Masquerading: Match Legitimate Name or Location).

Targets & Patterns

UAC-0099 primarily targets Ukrainian organizations in the technology and defense sectors, with historical focus on transportation and energy infrastructure. The targeting pattern reflects strategic interest in critical infrastructure and defense-related entities within Ukraine, consistent with Russia-aligned cyber operations during ongoing geopolitical conflict. The use of sophisticated anti-analysis techniques suggests the actor anticipates advanced defensive capabilities among its targets, particularly AI-enhanced security operations centers.

Historical Context

The GuardBreaker technique represents an evolution of anti-AI analysis tactics first observed in June 2026 during the Mini Shai-Hulud, Miasma, and Hades supply chain campaigns attributed to cybercrime group TeamPCP. Following the May 12, 2026 public leak of the Shai-Hulud worm source code, these techniques became available to other threat actors. UAC-0099's adoption demonstrates cross-pollination between cybercrime and nation-state tradecraft. CERT-UA previously warned of UAC-0099 activity in July 2026 involving MATCHBOIL delivery via fake Notepad++ plugins, indicating sustained operations against Ukrainian targets throughout 2026.

Defensive Recommendations

  • Implement content isolation in AI-assisted analysis pipelines to treat all analyzed code as untrusted data, preventing prompt injection attacks from triggering safety refusals
  • Deploy behavioral detection for VBS script execution (T1059.005) using EDR telemetry, focusing on scripts that download external payloads regardless of embedded text content
  • Monitor for masquerading attempts (T1036.005) where executables or plugins mimic legitimate software like Notepad++, validating digital signatures and installation sources
  • Establish multi-layered malware analysis workflows that do not solely rely on LLM-first triage, incorporating static analysis tools immune to adversarial prompt injection
  • Hunt for MATCHBOIL C# loader indicators in memory and on disk, focusing on unusual .NET assembly loading patterns and network connections to known UAC-0099 infrastructure

---

# Geopolitical Context

Geopolitical Context

The GuardBreaker technique represents an evolution in offensive cyber tradecraft consistent with Russia-aligned operations targeting Ukraine's critical infrastructure. UAC-0099's deployment of adversarial prompt injection—embedding nuclear weapon-related text to trigger LLM safety mechanisms—reflects adaptive tactics designed to counter the growing integration of AI-assisted security workflows in defensive operations. This activity aligns with sustained Russian cyber campaigns against Ukrainian technology and defense sectors since the onset of hostilities in 2022, demonstrating continued investment in techniques to degrade Ukraine's cyber defense posture. The technique's emergence follows similar adversarial AI methods observed in cybercrime contexts (TeamPCP supply chain attacks, June 2026), suggesting potential cross-pollination between state-aligned and criminal threat ecosystems or independent parallel development of counter-AI tactics.

State Actor Alignment

UAC-0099 is assessed by ESET and CERT-UA to be Russia-aligned, with established patterns of targeting Ukrainian transportation and energy sectors. The threat actor exclusively deploys MATCHBOIL, a custom C#-based loader, indicating sustained operational capability and strategic alignment with Russian state interests in degrading Ukrainian critical infrastructure. While attribution language remains appropriately hedged ("Russia-aligned"), the targeting pattern, tooling exclusivity, and geographic focus are consistent with state-sponsored or state-tolerated operations. The technique's sophistication—deliberately exploiting LLM safety guardrails—suggests access to technical intelligence regarding defender AI adoption, potentially indicating coordination with or support from entities possessing signals intelligence or insider knowledge of Ukrainian defensive capabilities.

Business Impacty pro region

For Ukraine, the GuardBreaker technique poses immediate operational risk to AI-enhanced security operations centers and automated malware triage systems increasingly adopted to manage high-volume threat environments. Ukrainian CERT-UA's July 2026 warning regarding UAC-0099's Notepad++ plugin campaign indicates ongoing targeting of technology and defense sectors, with AI evasion techniques potentially degrading detection efficacy across critical infrastructure defenders. For European allies providing cybersecurity assistance to Ukraine, the technique highlights vulnerabilities in AI-assisted security tooling that may affect NATO member states and EU institutions deploying similar LLM-based analysis platforms. The broader implication extends to global cybersecurity vendors integrating generative AI into security products—adversarial prompt injection represents a systemic weakness requiring architectural redesign of AI security workflows to isolate untrusted content from model inference paths. The technique's public disclosure may accelerate adoption by other state and non-state actors, as evidenced by the May 2026 leak of Shai-Hulud worm source code enabling widespread tactical replication.

Forecast

If AI-assisted malware analysis continues to proliferate without robust isolation of untrusted input from LLM inference engines, adversarial prompt injection techniques similar to GuardBreaker are likely to become standard components of state-aligned and sophisticated criminal malware. Ukrainian defenders may be compelled to implement stricter content sanitization, sandboxing, or hybrid human-AI workflows, potentially reducing operational tempo advantages AI was intended to provide. Should Russia-aligned actors observe successful evasion of AI defenses, expanded deployment of GuardBreaker variants across other APT groups targeting Ukraine and NATO members appears probable within 3-6 months. For the broader cybersecurity industry, vendors may face pressure to redesign LLM security products to treat all analyzed code as adversarial input, likely requiring architectural changes that could delay AI security tool adoption. If similar techniques proliferate to cybercrime ecosystems—as occurred with TeamPCP's parallel development—enterprise security operations centers globally may experience degraded efficacy of AI-powered triage systems, forcing reversion to manual analysis or investment in next-generation AI architectures with improved adversarial robustness.