Evolution of MATCHBOIL Downloader by UAC-0099

ESET has published a version-by-version breakdown of MATCHBOIL, the custom C# downloader used by the Russia-aligned UAC-0099 group. The malware fetches a payload from the group's command-and-control server, installs it, and establishes persistence. CERT-UA first documented it in August 2025, but ESET's sample set, anchored on two February 2026 VirusTotal uploads, pushes development back to at least April 2024, with the newest analyzed build compiled in April 2026.

The evolution is consistent and one-directional. Early builds used simple Unicode symbol renaming; newer ones are protected with the Eziriz .NET Reactor obfuscator. Successive versions added anti-sandbox checks, and samples compiled before November 2025 are markedly simpler to analyze than later ones. That trajectory, visible across telemetry from July 2025 through December 2025, shows MATCHBOIL is a maintained core asset of UAC-0099's intrusion chain rather than a one-off tool.

The report matters because downloader maturity is a reliable indicator of sustained operations. A group that has iterated one loader across two years, added obfuscation and environment checks, and kept its C2 infrastructure tied to previously attributed domains is running a stable espionage pipeline against Ukrainian targets. ESET's own timeline work also corrects the public record: the August 2025 CERT-UA disclosure marked discovery, not the start of activity.

Watch for MATCHBOIL.V2, which other vendors report in use from April to July 2026, and for the loader appearing alongside UAC-0099's newer .NET tooling. Updated ESET or CERT-UA detections, new sample uploads, and any shift in obfuscation or C2 domains would signal the next campaign wave. UAC-0099's documented role as an initial access broker for Sandworm makes any MATCHBOIL sighting worth treating as potential pre-positioning for a heavier follow-on attack.