Additionally, in 2025, the operators added a GUI in the form of a daily planner that appears if the user executes the malware manually. In 2026, it was changed to a Regex finder with a less conspicuous appearance. 5/7

Over the observed period, the analyzed MATCHBOIL samples evolved considerably, including code-level structure and code obfuscation techniques. The malware’s operators also constantly update its persistence mechanism, and improve defense evasion. 4/7

All of the malware’s victims seen in ESET telemetry during the investigation were from 🇺🇦 Ukraine, across various sectors - specifically transportation, manufacturing, and energy. 3/7

Although MATCHBOIL was first documented by CERT-UA in August 2025, our research indicates that it has been in development since at least 2024. Our analysis is based on samples from April 2024 to April 2026. 2/7

The presentation will be delivered in Spanish: “MATCHBOIL bajo la lupa: Un caso de atribución basada en la comparación y análisis de código.” 5/5

Accurate attribution is essential because it helps researchers and incident response teams stay informed and maintain visibility into the latest techniques, tactics, and procedures (TTPs) used by threat actors. 4/5

MATCHBOIL is one such example. Developed by the 🇷🇺 Russia-aligned APT group UAC-0099, the malware underwent significant changes between July 2024 and April 2026. 3/5

APT groups continuously update their malware, and in some cases, these updates can make existing malware appear entirely new. However, deeper analysis can reveal a different story. 2/5

The developers also implemented various anti-analysis techniques: SilentMoonwalk for call spoofing, concealing thread start address from security products using the MinHook library, and a custom PE loader with integrated host process camouflage. 5/6

With the transition to the new backdoor, FamousSparrow started to incorporate code from open-source projects directly into its malware. Specifically, we noticed that SparroWocky uses Mbed TLS, MinHook, and COFF Loader. 4/6

SparroWocky is a highly modular C++ backdoor built with stealthiness in mind. Its capabilities include collecting general info about the compromised machine, exfiltrating files, and taking screenshots. It can also load and execute BOF (Beacon Object File) files. 3/6

The switch to SparroWocky happened shortly after FamousSparrow started targeting Latin America almost exclusively, going mainly after governmental entities. This is most probably part of 🇨🇳 China’s reaction to the increased 🇺🇸 US interest in the region. 2/6

The intrusion began with a spearphishing email that led to the deployment of UAC-0099’s MATCHWOK backdoor. From there, attackers established a foothold and delivered a previously unseen backdoor ESET named MythicRatatoskr. 3/4