Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsMATCHBOIL is a C# downloader used by the Russia-aligned group UAC-0099 to retrieve and install other malware. ESET Research’s analysis of samples dated April 2024 through April 2026 shows that its core job has stayed the same while its communication, obfuscation, persistence, sandbox checks, and user-facing disguise have changed.
The timeline is based on ESET’s sample analysis, not a complete record of every deployment. ESET says CERT-UA first publicly documented MATCHBOIL in August 2025; the earlier development history is inferred from sample timestamps.
As an Amazon Associate I earn from qualifying purchases.
What is MATCHBOIL?
MATCHBOIL is a downloader: after execution, it gathers identifying information about the system and contacts command-and-control (C&C) infrastructure to obtain another payload. ESET reports that most cases it analyzed delivered MATCHWOK, a C# backdoor. CERT-UA describes MATCHWOK as able to receive and execute PowerShell commands. ESET Research’s technical analysis and CERT-UA’s 2025 campaign report describe those roles.
Recommended Free Tools
ESET characterizes UAC-0099 as a cyberespionage group targeting Ukrainian government organizations, financial institutions, and media. ESET assesses that the group is aligned with Russian interests with medium confidence, based on its targeting, and says it may act as an initial access broker for Sandworm. These are ESET’s assessments, not independently established attribution.
#1 Best Overall
- Superfast USB 3.0 Speeds: Enjoy blazing-fast data transfer with read speeds up to 400MB/s and write speeds up to 300MB/s, making it one of the fastest USB drives available.
- Physical Write-Protect Switch: Protect your files by locking the drive in "read-only" mode, preventing accidental overwriting and shielding it from virPhysical Write-Protect Switch: Protect your files by locking the drive in "read-only" mode, preventing accidental overwriting and shielding it from viruses and malware.uses and malware.
- Massive Storage Capacity: With capacities up to 512GB, the Kanguru SS3 provides ample space for storing large files like music, photos, videos, and more.
- Durable and Compact Design: Built with a high-strength aluminium casing, this lightweight drive is both sturdy and portable, perfect for on-the-go file storage.
- Plug-and-Play Compatibility: No software installation required. Simply plug the drive into Windows, Mac, or Linux systems and start transferring data instantly.
How does MATCHBOIL get installed?
ESET’s general delivery description
ESET describes spear-phishing links that download an archive containing a VBScript payload. The script downloads and runs MATCHBOIL, but the victim has to be induced to execute the script manually for this chain to work. Clicking a link alone is not the whole sequence ESET describes.
CERT-UA’s “court summons” campaign
CERT-UA separately reported an August 2025 campaign using phishing emails, sometimes with shortened links to legitimate file-sharing services. Its account describes ZIP archives containing a malicious HTA, followed by VBScript and PowerShell stages, and then a loader for MATCHBOIL. That is a campaign-specific chain; it should not be treated as the identical delivery method in every UAC-0099 operation.
Rank #2
- Military-Grade Security & Compliance: FIPS 140-2 Level 3 Certified with AES 256-bit hardware encryption for top-tier data protection, meeting strict standards like GDPR, HIPAA, SOX, and TAA compliance.
- Ultra-Fast USB 3.0 Performance: SuperSpeed USB 3.0 (USB 3.2 Gen 1x1) delivers high-speed data transfers, available in storage capacities up to 512GB, ideal for large files.
- Comprehensive Protection: Built-in tamper-resistant design with Award-Winning Bitdefender antivirus to protect against malware, plus remote management capabilities for added control.
- Remote Management Capabilities: Compatible with Kanguru Remote Management Console (KRMC-Hosted) for remote monitoring, security policy enforcement, and device tracking.
- Rugged & Tamper-Resistant Design: Waterproof, tamper-proof alloy casing with secure firmware to prevent "BadUSB" attacks, built to withstand harsh conditions.
In that campaign, CERT-UA named Ukrainian state authorities, Defense Forces, and defense-industrial enterprises as targets, and reported MATCHBOIL, MATCHWOK, and DRAGSTARE. ESET’s later telemetry is a different evidence set: it observed MATCHBOIL victims in Ukraine, including transportation, manufacturing, and energy organizations. Neither account establishes a complete victim count.
How has MATCHBOIL evolved?
ESET analyzed samples dated from April 2024 to April 2026. It says the earliest samples publicly documented by CERT-UA appeared in August 2025, while timestamps on earlier samples suggested they had been built in mid-2024. The entries below distinguish sample dates from ESET’s inferred chronology where timestamps were unreliable.
Rank #3
- 【Hardware Write Protection for Peace of Mind】Lock your files with a physical write protect switch to help prevent accidental deletion, formatting, and unauthorized changes. Ideal for business files, system backups, school documents, and sensitive data.
- 【USB-C & USB-A in One Drive】Transfer files seamlessly between smartphones, tablets, laptops, and desktops. Compatible with iPhone 17/16/15, MacBook, Windows, Linux, Chromebook, Samsung Galaxy, Google Pixel, and other USB-C or USB-A devices.
- 【Fast USB 3.2 Gen 1 Transfer】Enjoy speeds up to 140MB/s read and 70MB/s write for photos, videos, music, documents, and backups. Backward compatible with USB 2.0 devices.
- 【Premium 360° Metal Swivel Design】The durable metal body features a 360° swivel design with a satisfying click-lock mechanism to protect both connectors. Shock-resistant with an integrated keyring for everyday portability.
- 【Built for Work, School & Everyday Use】Pre-formatted in exFAT and supports OTG for broad compatibility. Perfect for professionals, students, photographers, teachers, and anyone needing secure portable storage.
| Sample period | Reported changes and behavior |
|---|---|
| 2024 samples | ESET found obfuscated C# names using unprintable Unicode symbols, encrypted strings, and three HTTPS requests. Persistence used both a registry Run key and a scheduled task. |
| July 2025 | ESET observed asynchronous task logic, collection of more device information, and persistence through a registry Run key. |
| November–December 2025 samples | ESET observed a two-minute communication timer, a graphical interface that appears when the payload is run, uptime-based sandbox checks, and changes to payload and configuration file handling. The samples had invalid timestamps; ESET infers their relative chronology from how they differ from the July samples. |
| 2026 samples | ESET reports further GUI changes and an April 2026 DLL sample run by a custom C# loader. ESET says CERT-UA also described that variant as MATCHBOIL.V2. |
What changed across versions
ESET describes a shift from Unicode-based obfuscation and string encryption toward Eziriz .NET Reactor, as well as changes to persistence and the gradual addition of sandbox detection. The two-minute timer in late-2025 samples represents a move beyond the earlier, more limited communication pattern. A GUI gives execution a visible user-facing element; it does not change the downloader’s underlying function.
What stayed the same
Despite those implementation changes, ESET says MATCHBOIL’s reported purpose remains fetching a payload from C&C and persisting it on the victim’s system. The evolution is principally about how the downloader runs and evades detection, not a documented change to its central role.
Rank #4
- Superfast USB 3.0 Speeds: Enjoy blazing-fast data transfer with read speeds up to 400MB/s and write speeds up to 300MB/s, making it one of the fastest USB drives available.
- Physical Write-Protect Switch: Protect your files by locking the drive in "read-only" mode, preventing accidental overwriting and shielding it from viruses and malware.
- Massive Storage Capacity: With capacities up to 512GB, the Kanguru SS3 provides ample space for storing large files like music, photos, videos, and more.
- Durable and Compact Design: Built with a high-strength aluminium casing, this lightweight drive is both sturdy and portable, perfect for on-the-go file storage.
- Plug-and-Play Compatibility: No software installation required. Simply plug the drive into Windows, Mac, or Linux systems and start transferring data instantly.
What do observed targets and locations tell us?
ESET says all MATCHBOIL victims in its telemetry were in Ukraine. Its reported observations include samples at multiple transportation companies in July–August 2025, a manufacturing company in December 2025, and an energy company in June 2026. These are dated telemetry observations, not a census of all victims or a measure of how prevalent the malware was.
Free tools Windows power users keep installed
One-click scans. No signup required.
CERT-UA’s August 2025 report describes a separate campaign aimed at Ukrainian state authorities, Defense Forces, and defense-industrial enterprises. Keeping the reports separate matters: ESET’s sector observations and CERT-UA’s campaign targets describe different scopes and should not be merged into one exhaustive target list.
What defenses does CERT-UA recommend?
CERT-UA’s recommendations address several points in the attack chain. They reduce opportunities for delivery or execution, and help surface activity, but they are not a guarantee of prevention.
- Email entry: Strengthen controls over incoming correspondence and treat unexpected links to archive downloads with caution.
- Script execution: Restrict or monitor HTA, VBScript, and PowerShell, particularly when launched from unusual locations.
- Endpoint persistence: Monitor for unexpected scheduled-task creation and changes to registry autorun settings.
- Network traffic: Use network intrusion detection or prevention and proxy filtering to help identify or block suspicious connections.
- Update hygiene: Keep operating systems, browsers, and antivirus databases up to date.
These controls correspond to the reported chain: phishing and archive delivery, script-driven execution, persistence on the endpoint, and communication with external C&C infrastructure.
Quick Recap
Sources
- ESET Research, “MATCHBOIL: New tricks, same old evil intentions,” October 8, 2026 — technical analysis and sample timeline.
- CERT-UA, “’Court Summons’ Phishing Lure Used in Cyberattacks on Ukrainian Government and Defence Sector,” August 29, 2025 — campaign chain, targets, and defensive recommendations.
- ESET, “Russian-aligned UAC-0099 intensifies attacks on Ukrainian industry with evolving MATCHBOIL downloader,” October 8, 2026 — newsroom summary and attributed researcher statements.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
