In an era of escalating cyber-espionage, the threat actor group UAC-0099 has emerged as a persistent adversary, targeting Ukrainian government agencies, military organizations, and defense-industrial entities since 2022.
Across three major campaigns (2023’s LONEPAGE, late-2024’s WinRAR-exploit phase, and 2025’s C#-based toolkit rollout), UAC-0099 has refined its toolkit while maintaining a consistent kill-chain framework built around spear-phishing, living-off-the-land execution, and web-based command and control.
From PowerShell to C#: Evolution of the Loader Arsenal
During the June 2023 “LONEPAGE” campaign, attackers dispatched double-compressed archives containing .LNK shortcuts or .HTA applications.
Opening these lures—often masquerading as legal subpoenas triggered a PowerShell-based loader (LONEPAGE) that fetched upgrade scripts via HTTP, executed commands in memory, and delivered credential stealers (THUMBCHOP), keyloggers (CLOGFLAG), reverse proxies (OVERJAM), and Go-based RATs (SEAGLOW).
Persistence was secured through scheduled tasks (e.g., OneDriveUpdateCoreFilesStart, FileExplorerUpdateTaskMachineCore) and Startup folder shortcuts.
By late 2024, UAC-0099 weaponized the WinRAR vulnerability CVE-2023-38831 to auto-run malicious payloads on archive extraction.
The revamped LONEPAGE split into a 3DES-encrypted config file and a .NET stub (update.win.app.com) that decrypted and executed PowerShell in memory.
Task names like Libraries\WinLibUpdateTask and ExplorerCoreUpdateTaskMachine evaded suspicion, while Cloudflare-fronted domains masked C2 traffic over HTTP/HTTPS.
MATCHBOIL, MATCHWOK, DRAGSTARE: The 2025 C# Suite
The August 2025 alert reveals a wholly new C#-based infection chain. Phishing emails now deliver double archives via shortened URLs, culminating in an HTA that deploys MATCHBOIL—a C# loader coded to:
MATCHWOK reads encrypted AES-256 commands from config.ini, spawns a renamed PowerShell binary in a non-standard path, executes attacker scripts, and exfiltrates results via HTTPS POST.
DRAGSTARE consolidates browser credential theft (DPAPI key retrieval, cookie and login extraction), recursive file harvesting (.docx, .pdf, .ovpn, .rdp), system and network reconnaissance (ping sweeps, ARP cache, active connections), screenshot capture, and DPAPI-protected config retrieval.
Detecting the Unseen – Key Indicators and Defenses
Despite UAC-0099’s layered obfuscation double archives, Base64/hex encoding, masqueraded file names (svchost.exe, firefox.exe), and scheduled tasks mimicking legitimate update services—several detection opportunities exist:
- Monitor Scheduled Task creation events (Windows Event ID 4698/Sysmon) for names containing “Update”, “Task”, “Core”, and paths under
%APPDATA%,%LOCALAPPDATA%, or%PUBLIC%. - Enable PowerShell Script Block and Transcription logging to capture
-EncodedCommandor-nop -w hiddenflags. - Restrict or whitelist mshta.exe, wscript.exe, cscript.exe, and powershell.exe via AppLocker or WDAC.
- Inspect outbound HTTP(S) headers for non-standard fields like “SN” or “Count” and anomalous User-Agent strings.
- Block archive auto-execution vulnerabilities by patching WinRAR and enforcing strict archive-handling policies.
As UAC-0099 transitions from PowerShell-centric scripts to custom C# implants, defenders must adapt surveillance and containment strategies, focusing on scheduled tasks, living-off-the-land binaries, and encrypted web-based C2.
Proactive logging, least-privilege controls, and network egress filtering can disrupt this group’s espionage campaigns before significant data exfiltration occurs.
.jpg?fit=1068,580&ssl=1&description=UAC-0099 tactics - In an era of escalating cyber-espionage, the threat actor group UAC-0099 has emerged as a persistent adversary.){kind=link}