MATCHBOIL: The Spy Tool quietly Expanding its Reach in Ukraine

Last updated: October 8, 2026

A Russia-aligned hacking group is quietly updating a piece of malware that serves as a doorway to corporate espionage. Researchers at ESET have been watching it for nearly two years, tracing how its code, hiding spots, and targeting have shifted. What started as a tool aimed at government and media in Ukraine now appears to be casting a wider net.

How MATCHBOIL Gets In

The infection chain begins with a carefully crafted email. A link in a spear phishing message downloads an archive containing a VBScript file, which then pulls down MATCHBOIL onto the Windows machine. Once running, the malware takes a snapshot of the hardware: it reads the CPU ID and BIOS serial number, then fires off three HTTPS requests to the attackers' server.

The second response is where things get interesting. It's HTML, but hidden inside is the actual payload, hex-encoded. Once decoded, the malicious code gets dropped into the user's local app data folder, where it arranges to restart itself either via the Windows Task Scheduler or by modifying the registry. If that directory already exists from a previous run, MATCHBOIL simply exits—it has already done its job.

The payload it installs is known as MATCHWOK, a C# backdoor capable of taking screenshots and running PowerShell commands on the compromised machine. ESET researcher Fernando Tavella confirmed to Help Net Security that the access this creates may end up being useful to other threat actors entirely.

Hiding in Plain Sight

The directories and file names have changed repeatedly, which suggests someone is actively maintaining the operation. During 2024, the covert file nestled within a directory labeled DeviceMonitor. By the end of 2025, threat actors had relocated the executable to MeowMeowProgramm.exe, placing it inside a folder labeled MeowCheck. The most recent build from April 2026 stores its executable as SMTPClientApplication.exe in a directory named SMTPClient, scheduling persistence through a task called Checker within a parent directory labeled MailClient. Security teams hunting for signs of infection should search for those names.

Persistence also evolved. Early versions ran once and relied on the scheduled task to carry them forward. By late 2025 MATCHBOIL added a two-minute timer, so a missed first call to the command server no longer kills the infection.

Around the same time, the group swapped its homemade string scrambling for Eziriz .NET Reactor, a commercial obfuscator that virtualizes code and scrambles control flow. Defenders who saw weird behavior but couldn't unravel it were likely looking at this layer.

The malware also started checking whether it is running in a sandbox. It reads Windows event logs looking for system uptime—checking in both English and Russian—and only proceeds if it finds at least three events showing 7,200 seconds (two hours) or more of uptime. The April 2026 build added another gate: it verifies the operating system was installed at least ten days before the malware runs. Both checks are designed to slip past analysis environments that spin up and tear down quickly.

The decoy side is less polished. Late 2025 builds include a daily planner window titled "Dairy" with two text boxes both labeled "Today" and a cat photo. Anyone who launches the malware by hand gets this charming distraction.

Quick take

• MATCHBOIL is a downloader used by UAC-0099 to plant the MATCHWOK espionage backdoor
• All confirmed victims are in Ukraine; new targets include transport, manufacturing, and energy
• The group rents infrastructure from BitLaunch with Cloudflare in front, using Let's Encrypt certificates
• UAC-0099 acts as an initial access broker, selling footholds to other groups including Sandworm
• Ukraine's CERT-UA documented the malware in August 2025, roughly a year after compilation timestamps suggest it first ran

Our Analysis

The shift in victimology is worth sitting with. UAC-0099 has historically gone after government bodies, financial institutions, and media in Ukraine. The addition of transportation, manufacturing, and energy companies suggests either a broader mandate or a change in who is paying for access. As an initial access broker working on behalf of Sandworm and potentially other APT groups, UAC-0099 has every reason to accumulate footholds in whatever sector looks most valuable at the moment.

The two-minute timer addition is a small but meaningful operational security win for the attackers. Earlier versions that ran once and expected the scheduled task to carry them forward could be starved out if the first phone home failed. Now MATCHBOIL will keep trying on its own clock, making the infection harder to disrupt.

For defenders, the directory and file names are useful indicators, but they will keep changing. The deeper tells are the event log check for two-hour uptime and the OS age requirement—both are harder to spoof without leaving traces.

A Practical Example

Say you manage IT for a mid-sized logistics firm in Ukraine. An employee receives an email that looks like it comes from a known supplier, with a link to download what appears to be a shipping manifest. They click it. Hours later, nothing seems wrong from their perspective. But MATCHBOIL is now fingerprinting the machine and dialling home. If the server responds with the hex-encoded payload, MATCHWOK gets installed, and within days someone on the other end can take screenshots of financial reports, capture credentials as they are typed, or use the machine as a jumping-off point into the broader network. By the time anyone notices, the initial access has already been sold to a second group with more specific objectives.

The lesson: the phishing link is the choke point. Training employees to treat unsolicited document links with suspicion, especially compressed archives, is not optional.

Who Should Care

• Ukrainian transport, energy, and manufacturing firms**: You are now in the targeting mix. Assume you are interesting to someone.
• Managed security providers covering Ukraine**: Check event logs for the directory names, scheduled task names, and the uptime thresholds.
• Threat intelligence teams**: UAC-0099 infrastructure uses BitLaunch with Cloudflare and unique Let's Encrypt certs per domain. Track accordingly.
• Supply chain security managers**: The spear phishing starts with trusted relationships. Verify requests for sensitive documents through a second channel.

Bottom Line

MATCHBOIL is not a zero-day wonder—it is a maintained, professionally updated piece of infrastructure with clear objectives in Ukraine. The widening victimology is the signal to watch. If UAC-0099 is branching into sectors that touch critical infrastructure, it is likely building access to sell, not keeping it for a single operation.

Key takeaways

• MATCHBOIL arrives via spear phishing; verify unsolicited document links through a separate channel before opening
• The directory and file names change constantly—search for uptime and OS age checks as harder-to-spoof indicators
• If you cover Ukrainian targets, treat transport, energy, and manufacturing as active targeting, not exceptions