UAC-0099: ESET Says This Ukraine-Focused Access Group Handed a Logistics Firm to Sandworm

Executive Summary

UAC-0099 is a cyberespionage cluster that targets Ukrainian government bodies, financial institutions and media. It is tracked under that identifier by CERT-UA, Ukraine’s national computer emergency response team. On 22 October 2026, ESET Research published a report on an intrusion at a Ukrainian grain logistics company in which UAC-0099 gained initial access in July 2025, deployed a previously undocumented backdoor (MythicRatatoskr) one day later, and, according to ESET, handed access to Sandworm, which ran a data-wiping attack on 17 September 2025. ESET attributes the UAC-0099 stage to that cluster “with high confidence” and the wiping to Sandworm “also with high confidence”, and assesses with high confidence that a handoff occurred.

Two earlier publications fill in the group’s tooling. ESET’s 8 October 2026 analysis traces the MATCHBOIL downloader through samples compiled from April 2024 to April 2026, and a CERT-UA advisory, as relayed by Security Affairs on 24 July 2026, describes a newer delivery chain that hides the loader inside a trojanised Notepad++ plugin.

In our assessment, the most useful lesson for defenders is the role split. The cluster that gets in is not the cluster that destroys. A Ukrainian organisation that sees MATCHBOIL, MATCHWOK or LONEPAGE on a host should treat it as potentially the first stage of an intrusion that later involves destructive actors, not as contained espionage. This is our reading of ESET’s single documented case; ESET itself calls a UAC-0099-to-Sandworm handoff “unusual in the specific actors involved, but no longer surprising as a pattern”, and cites earlier cooperation between other Russia-aligned groups.

Source basis. ESET is the primary source for the technical and attribution claims. CERT-UA is the original reporter of the group and of the Notepad++ chain, and we opened its Ukrainian-language advisory on the Notepad++ chain (read through a text-extraction proxy, so our reading of it rests on that one rendering). The delivery-chain details were cross-read against the Security Affairs article, which quotes it. ESET publishes from its own telemetry; the basis of CERT-UA’s reporting is not stated in the advisory text we read. We have not independently reproduced any of it.

Threat Actor Profile

Names and tracking. “UAC-0099” is the identifier CERT-UA uses for this cluster, and ESET uses the same name. We found no vendor alias in the three sources we opened, so this article does not equate UAC-0099 with any other vendor’s cluster name. Sandworm, which appears in the handoff, already has its own coverage on this site and is a separate actor in ESET’s account.

History. ESET states the group has been active since at least 2022 and was first reported by CERT-UA in June 2023. According to ESET, CERT-UA first documented MATCHBOIL in August 2025, although ESET’s samples suggest development since at least April 2024. Security Affairs, summarising the July 2026 CERT-UA advisory, describes the group as active since at least mid-2022 and “previously known for exploiting WinRAR vulnerabilities”.

Alignment and confidence. ESET says that, based on targeting, it believes with medium confidence that UAC-0099 is aligned with Russian interests. ESET does not name a government sponsor for UAC-0099. It does attribute Sandworm to GRU Unit 74455, which is the commonly cited attribution for that group, but that is a statement about Sandworm and not about UAC-0099. Our assessment is that UAC-0099 should be described as “Russia-aligned (medium confidence, ESET)” and not tied to any intelligence service.

Role. ESET writes that UAC-0099 “can act as an initial access broker for Sandworm”. In our reading, that conclusion rests on one documented intrusion. ESET also states it could not determine whether MythicRatatoskr was operated primarily by UAC-0099 or by Sandworm.

Tactics, Techniques and Tooling

Delivery

ESET describes spearphishing as the entry route in the logistics case, with a malicious attachment, and says this matches the CERT-UA account. In its MATCHBOIL report, ESET describes a link-based variant: the lure email links to an archive holding a VBScript that downloads and runs MATCHBOIL, and the victim must run the script manually.

The July 2026 CERT-UA advisory, as relayed by Security Affairs, describes this chain: a phishing email carries an image attachment that opens a shortened link to a file-sharing service, where a ZIP contains a VBScript with a fake PDF name and, per Security Affairs, possibly deliberate extra spaces before the .vbs extension. The script downloads a decoy PDF and a second archive, Evernote.zip, containing a complete Notepad++ 8.8.3 install, a malicious plugin NppExport.dll, a password-protected updater.rar and a legitimate winrar.exe. When Notepad++ starts it loads the plugin, which CERT-UA calls LUNCHPOKE. LUNCHPOKE unpacks the RAR, creates a scheduled task that runs RemoteLibUpdater.exe (named BURNYBEAR by CERT-UA) every three minutes, and that loader runs InitTest.dll, a modified MATCHBOIL that CERT-UA designates MATCHBOIL.V2. Security Affairs notes that BURNYBEAR consumes RAM and CPU if started without arguments, which may hinder automated analysis.

According to Security Affairs, CERT-UA recommends that administrators update WinRAR, 7-Zip and Notepad++. We note that the bundled winrar.exe means this particular chain does not depend on a vulnerable local copy; the update advice is general hygiene for the group’s other stages. That observation is also Security Affairs’ own.

MATCHBOIL and MATCHWOK

ESET’s 8 October report describes MATCHBOIL as a C# downloader that fetches a payload from its command server, installs it and persists it. It performs three HTTPS requests: one returns a numeric value later used as a custom HTTP header, a second returns HTML-formatted code containing a hex-encoded payload extracted by a regular expression, and a third returns a string saved as a configuration file. In most cases the payload is MATCHWOK, a C# backdoor that ESET says is used exclusively by UAC-0099 and was first documented by CERT-UA.

ESET records these changes over time:

• Logic moved from a one-shot downloader to, by late 2025, a two-minute timer that can fetch the latest payload.
• Obfuscation moved from Unicode symbol renaming and string encryption to the Eziriz .NET Reactor obfuscator.
• Persistence moved from a registry value plus scheduled task (2024), to a Run-key value (July 2025), to a scheduled task (late 2025).
• Sandbox checks were added from late 2025, along with a GUI shown when the payload is executed, made less conspicuous in early 2026.

ESET also lists LONEPAGE, a PowerShell downloader, as a typical UAC-0099 tool.

MythicRatatoskr and the Yggdrasil channel

ESET describes MythicRatatoskr as a previously undocumented Go backdoor that reaches its command server inside Yggdrasil, a decentralised encrypted IPv6 mesh network. The code is based on the open-source yggstack project. The backdoor embeds a base64-encoded list of 32 public peers, picks three at random, and communicates with the server over HTTPS on port 443 using JSON-encoded POST messages (checkin, tasking, result, getfile). Its commands include shell, upload, download, screenshot, ls, cd, pwd, expose, churl, chtime, nodeinfo and a reverse SOCKS5 proxy. ESET found hints that development began between December 2024 and February 2025, and filename conventions that suggest a Linux variant may exist; it says it has not seen the backdoor used anywhere else.

ESET notes that Yggdrasil traffic may evade network tools that look for conventional command servers, and that “blocking the public peer addresses is a viable mitigation”. A separate Go SOCKS5 server (internally bindProxy, listening on 127.0.0.1:33690) was also found, which ESET believes was deployed through MythicRatatoskr.

Targeting

ESET states that UAC-0099 targets government, financial and media organisations in Ukraine. Its telemetry for MATCHBOIL shows all victims in Ukraine and across several sectors: transportation companies in July and August 2025, a manufacturing company in December 2025, and an energy-sector company in June 2026. Two samples uploaded to VirusTotal in February 2026 also came from Ukraine. The logistics victim in the handoff case was a grain logistics company.

ESET’s telemetry is a sample of its own customers and cannot show the full victim set. We therefore do not read the sector list as exhaustive. The transport and grain victims fit an interest in Ukrainian logistics, though the manufacturing and energy victims do not obviously do so, and ESET does not state a collection objective, and neither do the other sources we opened.

Documented Incidents

• 2022: Earliest activity, per ESET and Security Affairs (ESET; Security Affairs)
• June 2023: First CERT-UA report on the group (ESET)
• April 2024: Compilation date of earliest MATCHBOIL samples analysed (ESET (MATCHBOIL))
• 16 July 2025: Scheduled task pdfopentask runs; MATCHBOIL deploys MATCHWOK at a Ukrainian grain logistics company (ESET (MythicRatatoskr))
• 17 July 2025: MythicRatatoskr delivered; later copied to other machines using an OpenSSH SFTP server (ESET (MythicRatatoskr))
• July to August 2025: MATCHBOIL samples seen at transportation companies (ESET (MATCHBOIL))
• August 2025: CERT-UA first documents MATCHBOIL and MATCHWOK (ESET (MATCHBOIL))
• 17 September 2025: SDelete data-wiping via Active Directory Group Policy at the logistics victim, attributed by ESET to Sandworm (ESET (MythicRatatoskr))
• December 2025: MATCHBOIL seen at a manufacturing company (ESET (MATCHBOIL))
• June 2026: MATCHBOIL seen at an energy-sector company (ESET (MATCHBOIL))
• July 2026: CERT-UA advisory on the Notepad++ plugin chain (published by Security Affairs 24 July) (Security Affairs)
• 8 October 2026: ESET publishes MATCHBOIL analysis (ESET)
• 22 October 2026: ESET publishes MythicRatatoskr and the handoff (ESET)

The handoff in detail. ESET reports that, at 06:59 on 16 July 2025, a scheduled task named pdfopentask ran a PowerShell payload from %temp%\temporarydoc.txt. A minute later MATCHBOIL fetched MATCHWOK. The next day MythicRatatoskr arrived. Because of the close timing, ESET believes “with high confidence” that the MATCHWOK chain led to MythicRatatoskr. Roughly two months later, on 17 September 2025, ESET saw SDelete deployed through Group Policy, which it describes as standard Sandworm techniques that it has seen numerous times. ESET rates the handover conclusion as high confidence; in our reading it is an inference from the timing, the tooling and the TTPs.

Indicators of Compromise

All indicators below are taken from ESET’s reporting and defanged. ESET’s blog posts also list hashes and further MATCHBOIL command-server domains that are not reproduced here; ESET’s GitHub IOC repository (github.com/eset/malware-ioc) was not opened. Treat the indicators as historical; they were observed in 2025 and may no longer be live.

• MATCHWOK command server: uztickets[.]com (ESET, MythicRatatoskr report)
• MATCHBOIL payload location: egyptanimals[.]com/animals/photoalbum (ESET, MythicRatatoskr report)
• MythicRatatoskr command server (Yggdrasil): 201:b479:2771:8df4:b5eb:d007:63b0[:]2838, port 443; reverse proxy on port 8080 of the same address (ESET)
• Service name: ieupdate; MATCHWOK persistence value: UpdateMonitor under HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ (ESET)
• Configuration paths: C:\Windows\Temp\.updatecache, C:\Windows\system32\.updatecache, %LocalAppData%/Temp/.crond (ESET)
• Notable install paths: C:\windows\system32\updater.exe, C:\Windows\system32\krbtman.exe, %localappdata%\Microsoft\OneDrive\OneDriveLiveUpdater.exe, %localappdata%\SMBCache\nbtresolver.exe (SOCKS5 server) (ESET)
• LUNCHPOKE staging: %PUBLIC%\Libraries\<random>\RemoteLibUpdater.exe; scheduled-task directory under \W1n3r-U09oTy-Ap5\Updates, run with arguments setup nodisplay every three minutes; file-sharing service EasySend[.]co, which CERT-UA labels a legitimate resource (abused). The %PUBLIC%\Libraries\<random> directory name changes (CERT-UA). CERT-UA also lists two command servers for this chain: kaufen-qpon[.]icu and 64.94.84[.]204

Defensive Implications

The following are our assessment, drawn from the behaviours the sources describe.

1. Hunt the host artefacts, not just the domains. Command-server domains rotate, and the victim node’s Yggdrasil address is regenerated at each run (ESET). The C&C address in the analysed MythicRatatoskr samples is hardcoded, though the churl command can change it, so hunt on the C&C address and the embedded peers rather than the victim address. Scheduled tasks named like pdfopentask, a service called ieupdate, .updatecache files and a Run-key value UpdateMonitor are starting points from one documented intrusion only; ESET shows the group rotating task names, install directories and config paths between samples (for example MATCHBOIL task names moved from Updates\CheckTask to UpdateCheckers\DailyPlanner to MailClient\Checker), so treat them as examples, not stable signatures.
2. Block the Yggdrasil public peers. ESET names this as a viable mitigation because the backdoor must reach one of its embedded 32 peers to join the mesh. ESET reproduces the peer list in its report.
3. Treat plugin directories as an execution path. In the CERT-UA-described chain, the plugins\NppExport directory holds the malicious plugin DLL and a password-protected RAR alongside a bundled winrar.exe. Alert on newly written plugin DLLs, and on Notepad++ launched from %PUBLIC% or archive-extraction paths.
4. Restrict script execution from downloads. Both the ESET MATCHBOIL report and the CERT-UA account rely on a user opening a VBScript that masquerades as a document. Blocking .vbs execution from archives and showing real file extensions both break that step.
5. Watch for Group Policy deploying utilities. In the handoff case, the wiping was staged via Group Policy two months after initial access. Alert on SDelete or similar tools pushed through Group Policy Objects, and review long-dwell hosts for UAC-0099 tooling before the next stage lands.
6. Update archive tools. CERT-UA’s advice, as relayed by Security Affairs, is to update WinRAR, 7-Zip and Notepad++.

What We Could Not Establish

• We read the CERT-UA Notepad++ advisory only through a text-extraction proxy of its Ukrainian text; we did not open CERT-UA’s earlier advisories on the group.
• We found no source in the three we opened that names a victim count for UAC-0099 or identifies the final payloads in the Notepad++ campaign (as of 11 November 2026, in these three sources).
• ESET’s handoff finding rests on one intrusion, and ESET could not say who operated MythicRatatoskr.
• ESET does not name a state sponsor for UAC-0099; the “Russia-aligned” label is medium confidence from targeting.

References

• ESET Research, “MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration” (22 October 2026): https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/
• ESET Research, “MATCHBOIL: New tricks, same old evil intentions” (8 October 2026): https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/
• CERT-UA, advisory on the UAC-0099 Notepad++ plugin chain: https://cert.gov.ua/article/6318634
• Security Affairs, “UAC-0099 Is Now Hiding Malware Inside a Fake Notepad++ Plugin to Target Ukrainian Organizations” (24 July 2026): https://securityaffairs.com/195923/cyber-warfare-2/uac-0099-is-now-hiding-malware-inside-a-fake-notepad-plugin-to-target-ukrainian-organizations.html