Run it by hand and it shows you a daily planner, complete with two boxes both labelled Today and a typo in the window name suggesting it is meant for planning your milk intake. Run it the way its operators intended and it quietly checks whether it is inside a security sandbox, then starts fetching a backdoor every two minutes.
That decoy is one of many changes ESET researcher Fernando Tavella documents in a new analysis of MATCHBOIL, a custom C# downloader used by UAC-0099, a cyberespionage group ESET assesses with medium confidence to be aligned with Russian interests. The research shows a tool that has been rebuilt repeatedly and is still being aimed at Ukrainian companies, most recently in the energy sector.
Older than anyone had documented
CERT-UA first documented MATCHBOIL in August 2025. ESET says compilation timestamps in samples it found, and in the ones CERT-UA described, show the malware was already being built in April 2024. The newest sample ESET analyzed dates from April 2026.
Every victim ESET has seen in its telemetry was in Ukraine. The downloader turned up at multiple transportation companies in July and August 2025, at a manufacturing company in December 2025, and at an energy company in June 2026. ESET describes UAC-0099 as targeting Ukrainian government bodies, financial institutions and media, and notes that it can act as an initial access broker for Sandworm, the Russia-aligned group best known for destructive attacks in Ukraine. Last month IntelFusions reported on the same group's attempt to trip up AI code scanners with a planted request in its VBScript.
From one-shot tool to persistent foothold
MATCHBOIL arrives through spearphishing links that download an archive containing a VBScript, which the victim has to be tricked into running. Its job is simple and has not changed: fetch a payload from the command server, install it, and make it persist. ESET says that payload is usually MATCHWOK, a C# backdoor used only by UAC-0099.
What changed is everything around that job. According to ESET:
- Early versions ran once. From late 2025 the downloader runs on a two-minute timer, so it can pull the latest payload or retry after a failed connection.
- Obfuscation moved from unprintable Unicode names and custom string encryption to the commercial Eziriz .NET Reactor protector, which makes analysis harder.
- Persistence switched back and forth between a registry Run key and scheduled tasks.
- Sandbox checks arrived in late 2025: the malware reads Windows event logs to confirm the machine has been up for at least two hours, and the April 2026 variant also checks that the operating system was installed at least 10 days earlier.
- Decoy interfaces appeared, first the planner, then a text search utility, and installed file names became less conspicuous.
The April 2026 sample is the first delivered as a DLL launched by a custom C# loader, a variant CERT-UA has named MATCHBOIL.V2.
Hunt for the file names and hashes ESET published
Defenders in Ukraine and at organizations working with Ukrainian partners can look for scheduled tasks named UpdateCheckers\DailyPlanner or MailClient\Checker, payload directories such as %LOCALAPPDATA%\MeowCheck and %LOCALAPPDATA%\SMTPClient, and the mutex Global\PlannerAssistant. Selected SHA-1 hashes from ESET's report:
- F886B615CB9E23EAD2718FF2A61155ACFB04CE9E
- 1E2C4AAC30EDFF86CD9A30BD08B199BCD3D0CCCE
- C85D28F7D272CE2BBBFB9DAE71D21BF25B8D00FC
- 050926727CDD74F0B3A8A098E60B76D10FB06B14
None of these upgrades changes what MATCHBOIL does. They change how long it survives a defender's attention, and two years of steady investment suggests UAC-0099 expects to need it for a while yet.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.