UAC-0099

Oct 23 – October 25, 2026 · 2 reports

• Sandworm and UAC-0099 teamed up for a destructive wiper attack on a Ukrainian logistics company, with UAC-0099 (aka Earth Sirrush) gaining initial access on July 16, 2025 via a spear-phishing attachment, per ESET. The intrusion involved a previously undocumented mesh-network backdoor. (The Hacker News) · Oct 25 · observed · via phishing email · as sandworm · Threat Activity
• MythicRatatoskr hides its C2 inside the Yggdrasil mesh network. ESET documents a previously unreported Go backdoor used against a Ukrainian grain logistics firm: UAC-0099 gained initial access on July 16, 2025 and handed it to Sandworm, which ran a data-wiping attack on September 17, 2025. ESET · Oct 23 · observed · as sandworm · Threat Activity

Oct 8 – October 11, 2026 · 3 reports

• UAC-0099 has a previously undocumented .NET RAT. TrendAI attributes ASHVEIN (internally "TelemetryBrowser") to the Russia-aligned group it tracks as Earth Sirrush, used against Ukrainian government personnel. It steals Chrome and Firefox credentials, captures GDI screenshots, runs PowerShell remote shells, and hides tasking inside invisible HTML elements; some variants use a GitHub dead drop resolver as C2 fallback, with delivery via DLL sideloading, VHD containers and .NET droppers. ESET has previously described the group as an initial-access broker for Sandworm. The Hacker News · Oct 11 · observed · as earth sirrush · Threat Activity
• ESET traced MATCHBOIL back further than CERT-UA's first write-up. The C# downloader used by Russia-aligned UAC-0099 against Ukrainian targets has versions from April 2024 through April 2026, each iteration more sophisticated in how it fetches, installs and persists its payload (ESET, Dark Reading) (earlier coverage). · Oct 9 · observed · Threat Activity
• UAC-0099 / Earth Sirrush embeds ZIP payloads inside PNG images, extracted via predefined markers, with spear-phishing for access, scheduled-task persistence, C2 tasking hidden in invisible HTML footer elements, sandbox checks and hybrid AES-RSA C2 encryption (technical brief). · Oct 8 · observed · via phishing email · as earth sirrush · Threat Activity

Oct 7 – October 9, 2026

• CrowdStrike named the tooling behind the South Korean bank intrusions: ARTEX, a recently released Chinese open-source LLM multi-agent pentest framework, running DeepSeek v4.1-flash as its main backend with Z.ai GLM-5.3 and Grok 4.6 supplementing. The campaign was found through open directories on a Hong Kong IP (38.244.50[.]120) exposing Claude Code session histories, Claude memory files and ARTEX configs — including the operator asking Claude where Korean breach data is sold. Active late September to early October 2026, unattributed but assessed as a financially motivated Chinese-speaking operator; more than 25,000 customer records were taken from Shinhan Bank alone, and ARTEX has since gone closed source (The Hacker News, The Decoder) (earlier coverage). · Oct 9 · observed · AI & Model Security

Aug 28 – September 2, 2026 · 3 reports

• UAC-0099 is weaponising LLM safety filters as an anti-analysis technique. ESET's GuardBreaker write-up describes the Russia-aligned actor embedding nuclear-weapons-themed content in malware to deliberately trip refusal behaviour and block AI-assisted reverse engineering of samples (The Hacker News). Follows the same actor's activity noted last week (earlier coverage). · Sep 2 · observed · AI & Model Security
• ESET documented GuardBreaker, an anti-EDR technique used by Russia-aligned UAC-0099 against a Ukrainian victim (@thegrugq), continuing a busy week for the group (earlier coverage). Separate analysis traces a UAC-0099 WSF lure through a LUNCHPOKE → BURNYBEAR → MATCHBOIL.V2 chain with claimed overlap into Sandworm activity (chain analysis). · Aug 29 · observed · Threat Activity
• UAC-0099 is deliberately tripping LLM safety filters to block malware analysis. ESET documented GuardBreaker, used against a Ukrainian victim: the operators pad a malicious VBS downloader with a comment asking for help building a nuclear weapon, so an AI-assisted analysis pipeline refuses and never reaches the actual MATCHBOIL installer logic (ESET Research). Anyone running LLM triage in a malware workflow should assume this is now standard tradecraft. · Aug 28 · observed · AI & Model Security

Jul 24 – July 25, 2026

• UAC-0099 hides MATCHBOIL.V2 in a fake Notepad++ plugin. CERT-UA attributes a new campaign using a malicious Notepad++ plugin to backdoor Windows systems to the Russia-aligned cluster. The Hacker News. · Jul 25 · observed · via browser extension · Threat Activity