Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift
ID: 4b8b2fa6-b7cf-5d6d-b3f7-fc29a9109533
STIX ID: report--4b8b2fa6-b7cf-5d6d-b3f7-fc29a9109533
Feed Name: Dark Reading
Threat Score
ESET reports that UAC-0099—likely Russia-aligned—is actively using an evolving downloader called MatchBoil to deploy the MatchWok backdoor against Ukrainian transportation, manufacturing, and energy sectors; the analysis highlights rapid development since 2024, stronger obfuscation (including .NET Reactor), sandbox evasion, changing persistence mechanisms, and frequent C2 polling to fetch updated payloads.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.