CyberNew CyberNew
Ransomware & Malware The Record 1 week ago

Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms

CN
CyberNew Threat Research Desk
• Original Reporting: The Record
CyberNew Threat Intel Assessment
Assessed Severity: MEDIUM
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"Credit: European Union in Ukraine / Flickr Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms Russian-aligned hackers have targeted Ukrainian transportation, manufacturing and energy companies with a constantly evolving malware strain designed to harvest system data, according to new research. The malware, known as MatchBoil, is used by UAC-0099, a..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Ukraine railroad
Credit: European Union in Ukraine / Flickr

Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms

Russian-aligned hackers have targeted Ukrainian transportation, manufacturing and energy companies with a constantly evolving malware strain designed to harvest system data, according to new research.

The malware, known as MatchBoil, is used by UAC-0099, a cyberespionage group that Slovak cybersecurity firm ESET believes is likely working in Russia’s interests. In a report on Thursday, ESET said all MatchBoil infections it has observed were in Ukraine.

Researchers detected the malware at several transportation companies between July and August 2025, at a manufacturing company that December and at an energy-sector company in June 2026.

MatchBoil is typically delivered through malicious links in phishing emails. Clicking a link downloads an archive containing files that ultimately execute the malware on the victim’s computer. MatchBoil can collect information about the infected machine, download additional malicious software from an attacker-controlled server and establish persistence, allowing it to remain on the system.

Ukraine’s computer emergency response team, CERT-UA, first publicly documented MatchBoil in August 2025. But ESET said its analysis shows the malware had been under development since at least July 2024, with a newer version appearing as recently as April 2026.

Over that period, the hackers repeatedly modified MatchBoil to make it harder for security software to detect and analyze, improve how it deceives victims and gather more information about infected computers.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from The Record.

Primary Advisory →