[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPBDoLjyRtIi8ZI9SvRm934fBpIVBScBbtk5gA-HHRSc":3},{"article":4,"iocs":38,"watch_terms":42,"solutions":43,"lesson":138},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"e073e445-05e0-4844-a679-c0445784c16e","Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift","russian-spies-give-matchboil-malware-a-stealthy-facelift-b7077e","Cyber-espionage actor UAC-0099 has been steadily refining its flagship dropper in campaigns targeting Ukrainian organizations.","The Russian cyber-espionage actor UAC-0099 has updated its 'MatchBoil' malware, enhancing its stealth capabilities. This refined dropper has been observed in ongoing campaigns specifically targeting Ukrainian organizations, indicating a continued focus on intelligence gathering against the nation.","Russian spies update 'MatchBoil' malware for stealthy attacks on Ukraine.","https:\u002F\u002Fwww.darkreading.com\u002Fcyberattacks-data-breaches\u002Frussian-spies-matchboil-malware-facelift","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblte9326a6a1bce6d31\u002F6ac6bf347f984a40d88b6862\u002Fmatchboil_Gorodenkoff_shutterstock.jpg?width=720&quality=80&disable=upscale","2026-10-08T18:01:50+00:00","2026-10-08T20:00:14.068875+00:00",8,[17],{"name":18,"type":19},"UAC-0099","threat_actor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":20,"icon":22,"name":23,"slug":24},null,"Nation-state","nation-state",[26,28,33],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[39],{"type":32,"value":40,"context":41},"MatchBoil","Flagship dropper malware used by UAC-0099",[],{"controls":44,"vendors":131},[45,74,103],{"slug":46,"name":47,"problem":48,"products":49},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[50,58,66],{"vendor_slug":51,"vendor_name":52,"vendor_logo":53,"product_slug":54,"product_name":55,"url":56,"description":57},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":75,"name":76,"problem":77,"products":78},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[79,87,95],{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"slug":37,"name":104,"problem":105,"products":106},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[107,115,123],{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[132],{"slug":133,"name":134,"logo_path":135,"roles":136},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[137],"reported_by",{"slug":139,"title":140,"body":141,"framework_refs":142,"framework_notes":155},"russian-apt-uac-0099-upgrades-matchboil-malware-with-enhanced-stealth-against-ukrainian-targets","Russian APT UAC-0099 Upgrades MatchBoil Malware with Enhanced Stealth Against Ukrainian Targets","The Russian cyber-espionage group UAC-0099 has deliberately refined its MatchBoil malware dropper to evade detection, demonstrating how sophisticated threat actors continuously adapt their tooling to bypass existing defenses. This evolution highlights the danger of relying on static, signature-based detection methods against nation-state adversaries who actively study and circumvent them. Organizations targeted by state-sponsored actors — particularly those connected to geopolitically sensitive regions — face a persistent and evolving threat that requires layered, behavior-based detection strategies. The ongoing campaign against Ukrainian organizations underscores that intelligence-gathering operations do not pause, making continuous monitoring and threat intelligence integration essential.",[143,144,145,146,147,148,149,150,151,152,153,154],"MITRE ATT&CK T1036 (Masquerading)","MITRE ATT&CK T1027 (Obfuscated Files or Information)","MITRE ATT&CK T1566 (Phishing - Initial Access)","CIS Control 10 - Malware Defenses","CIS Control 13 - Network Monitoring and Defense","CIS Control 17 - Incident Response Management","NIST SP 800-61 Rev. 2 - Incident Response","NIST SP 800-137 - Continuous Monitoring","NIST DE.CM-4 - Malicious Code Detection","NIST RS.AN-2 - Incident Analysis","ISO\u002FIEC 27001 A.12.2 - Protection from Malware","ISO\u002FIEC 27001 A.16.1 - Incident Management",{"NIST RS.AN-2 - Incident Analysis":156,"CIS Control 10 - Malware Defenses":157,"MITRE ATT&CK T1036 (Masquerading)":158,"NIST DE.CM-4 - Malicious Code Detection":159,"NIST SP 800-137 - Continuous Monitoring":160,"NIST SP 800-61 Rev. 2 - Incident Response":161,"ISO\u002FIEC 27001 A.16.1 - Incident Management":162,"CIS Control 17 - Incident Response Management":163,"ISO\u002FIEC 27001 A.12.2 - Protection from Malware":164,"MITRE ATT&CK T1566 (Phishing - Initial Access)":165,"CIS Control 13 - Network Monitoring and Defense":166,"MITRE ATT&CK T1027 (Obfuscated Files or Information)":167},"Incident analysis helps understand how MatchBoil evaded defences and improve detection.","Malware defences with behavioural detection are needed against evolving droppers like MatchBoil.","Masquerading helps MatchBoil appear legitimate, so verifying file and process identity is key.","Malicious code detection must go beyond signatures to catch evolving droppers.","Continuous monitoring helps detect evolving threats that static defences miss.","Incident response guidance helps teams investigate and contain espionage malware.","Incident management processes help respond consistently to espionage malware infections.","Incident response management helps contain MatchBoil infections and adapt defences as tooling evolves.","Protection from malware requires layered defences, not only signatures.","Phishing is UAC-0099's initial access route, so email filtering and training target the entry point.","Network monitoring can detect MatchBoil's command traffic even when the file evades detection.","Obfuscation lets MatchBoil evade signature-based detection, which behaviour-based tools can counter."]