MATCHBOIL: New tricks, same old evil intentions

ESET researchers documented the evolution of MATCHBOIL, a custom C# downloader used by the UAC-0099 APT group aligned with Russia. MATCHBOIL downloads payloads from C2 servers, installs them, and maintains persistence on infected systems. Initial versions used Unicode symbol obfuscation and custom string encryption; later versions employed the Eziriz .NET Reactor obfuscator. The malware progressively added sandbox detection techniques, changed persistence from registry keys to scheduled tasks, and introduced deceptive graphical interfaces. Distribution occurs primarily through spearphishing emails containing malicious links that download VBScript files. MATCHBOIL often delivers the MATCHWOK backdoor as the final payload. Observed victims are exclusively Ukrainian organizations in critical sectors.

MATCHBOIL enables attackers to establish persistent access to victim machines, facilitating further payload delivery such as the MATCHWOK backdoor. This compromises the confidentiality, integrity, and availability of targeted systems, particularly affecting Ukrainian organizations in transportation, manufacturing, and energy sectors. The malware's evolving obfuscation and sandbox evasion techniques increase its stealth and complicate detection and mitigation efforts.

No official patch or fix is available as this is malware rather than a software vulnerability. Mitigation should focus on preventing spearphishing attacks by educating users, implementing email filtering to block malicious links and attachments, and employing endpoint detection and response solutions capable of identifying and blocking MATCHBOIL and its associated payloads. Network defenders should monitor for indicators of compromise such as the provided IP addresses, domains, and file hashes. Since this is a targeted threat, organizations in affected sectors should apply heightened vigilance and incident response readiness.