#ESETresearch has analyzed the evolution of #MATCHBOIL, a C# downloader used by the 🇷🇺 Russia-aligned APT group UAC-0099 to download, install, and persist another payload.
@reib3n1

https://
welivesecurity.com/en/eset-…

— from @ESETresearch (https://x.com/ESETresearch/status/2108227114314928419)

#ESETresearch’s Fernando Tavella presented these findings at Ekoparty 2026 in Buenos Aires. #EKO26 ekoparty.org 6/7

#ESETresearch has analyzed the evolution of #MATCHBOIL, a C# downloader used by the 🇷🇺 Russia-aligned APT group UAC-0099 to download, install, and persist another payload. @reib3n1 www.welivesecurity.com/en/eset-rese... 1/7

#ESETresearch’s Fernando Tavella will be presenting at Ekoparty in Buenos Aires, Argentina 🇦🇷. Join him in Room C3 on October 8 at 11:15 a.m. local time for “MATCHBOIL Under the Microscope: An Attribution Case Based on Code Analysis.” ekoparty.org/ekoparty-bue... 1/5

#ESETresearch’s Fernando Tavella will be presenting at Ekoparty in Buenos Aires, Argentina 🇦🇷. Join him in Room C3 on October 8 at 11:15 a.m. local time for “MATCHBOIL Under the Microscope: An Attribution Case Based on C…

— from @ESETresearch (https://x.com/ESETresearch/status/2107357722345652593)

#ESETresearch discovered SparroWocky, a new backdoor of the #FamousSparrow APT group. This new malware has quickly replaced SparrowDoor as the 🇨🇳 China-aligned group’s flagship backdoor.
https://
welivesecurity.com/en/e…

— from @ESETresearch (https://x.com/ESETresearch/status/2100510108052513106)

#ESETresearch discovered SparroWocky, a new backdoor of the #FamousSparrow APT group. This new malware has quickly replaced SparrowDoor as the 🇨🇳 China-aligned group’s flagship backdoor. www.welivesecurity.com/en/eset-rese... 1/6

Heading to #LABScon2026? Join #ESETresearch’s Anton Cherepanov and Peter Strýček on Sept. 18 at 2:45 PM MST in Scottsdale, AZ for: Inside a Sandworm Attack: UAC-0099 Access and a Yggdrasil-backed Backdoor. 1/4

— from @ESETresearch (https://x.com/ESETresearch/status/2100192893193335164)

Heading to #LABScon2026? Join #ESETresearch’s Anton Cherepanov and Peter Strýček on Sept. 18 at 2:45 PM MST in Scottsdale, AZ for: Inside a Sandworm Attack: UAC-0099 Access and a Yggdrasil-backed Backdoor. 1/4

How does 🇰🇵ScarCruft (APT37) maintain long-term access across campaigns? #ESETresearch uncovered CinderRelay, a previously undocumented Linux server backdoor used to retain control of compromised infrastructure. 2/4

— from @ESETresearch (https://x.com/ESETresearch/status/2099769167826059742)

Join #ESETresearch’s Filip Jurčacko at #LABScon2026, on Sept. 18 at 2:15 PM MST in Scottsdale, AZ for CinderRelay: The Linux Backbone of ScarCruft’s Covert Network. 1/4

— from @ESETresearch (https://x.com/ESETresearch/status/2099769165527626015)

How does North Korea-aligned ScarCruft (APT37) maintain long-term access across campaigns? #ESETresearch uncovered CinderRelay, a previously undocumented Linux server backdoor used to retain control of compromised infrastructure. 2/4

Join #ESETresearch’s Filip Jurčacko at #LABScon2026, on Sept. 18 at 2:15 PM MST in Scottsdale, AZ for CinderRelay: The Linux Backbone of ScarCruft’s Covert Network. 1/4