[uac-0099]

September 2, 2026

• UAC-0099 is weaponising LLM safety filters as an anti-analysis technique. ESET's GuardBreaker write-up describes the Russia-aligned actor embedding nuclear-weapons-themed content in malware to deliberately trip refusal behaviour and block AI-assisted reverse engineering of samples (The Hacker News). Follows the same actor's activity noted last week (earlier coverage). · AI & Model Security

in OpenAI Says Astra Crossed the Line: Autonomous Zero-Day Discovery at "Critical" Cyber Risk

August 29, 2026

• ESET documented GuardBreaker, an anti-EDR technique used by Russia-aligned UAC-0099 against a Ukrainian victim (@thegrugq), continuing a busy week for the group (earlier coverage). Separate analysis traces a UAC-0099 WSF lure through a LUNCHPOKE → BURNYBEAR → MATCHBOIL.V2 chain with claimed overlap into Sandworm activity (chain analysis). · Threat Activity

in PaperCut Ships a Second Emergency Patch After Researchers Bypass the First

August 28, 2026

• UAC-0099 is deliberately tripping LLM safety filters to block malware analysis. ESET documented GuardBreaker, used against a Ukrainian victim: the operators pad a malicious VBS downloader with a comment asking for help building a nuclear weapon, so an AI-assisted analysis pipeline refuses and never reaches the actual MATCHBOIL installer logic (ESET Research). Anyone running LLM triage in a malware workflow should assume this is now standard tradecraft. · AI & Model Security

in Australia Charges Two Over the TeamPCP Supply-Chain Spree