As cited
Copy frozen at (site build).
threat intel
Sandworm-Linked Group Sharpens Matchboil Downloader
Russia-aligned group UAC-0099 has refined Matchboil, a downloader targeting Ukrainian transport, energy, and manufacturing organizations, adding support for persistent command-and-control traffic and improved evasion tactics since at least 2024. The updated tool now delivers the Matchwok backdoor to compromised systems.
Why it matters: Organizations in Ukrainian critical infrastructure and manufacturing face evolving threats from a Sandworm-linked adversary with demonstrated persistence and technical advancement; practitioners should review detection signatures for Matchboil and Matchwok and assess exposure in these sectors.
- First seen by Cybersecurity Tracker