Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis
Russia-aligned UAC-0099 uses malware with a nuclear weapon prompt to trick AI analysis.
Run MATCHBOIL?
Get an email when a reviewed story names MATCHBOIL, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A Russia-aligned threat actor, UAC-0099, is employing a new technique called GuardBreaker, embedding a nuclear weapon prompt within malware to disrupt AI-assisted analysis. This tactic aims to trigger Large Language Model (LLM) safety mechanisms, preventing the AI from analyzing the malicious code. The VBS script, which downloads a C#-based loader called MATCHBOIL, is part of a broader toolset targeting sectors like transportation and energy.
The lesson from this incident
Full lessonThe Russia-aligned threat actor UAC-0099 is pioneering 'GuardBreaker,' a technique that embeds adversarial nuclear weapon prompts inside malware to exploit LLM safety guardrails and prevent AI-assisted security tools from analyzing malicious code. This represents an evolution in evasion tactics where attackers no longer just hide from traditional detection engines but actively weaponize AI safety mechanisms against defenders. Security teams that rely heavily on AI-assisted analysis without human oversight or alternative analysis pipelines are especially vulnerable to this blind spot. The underlying MATCHBOIL loader targeting transportation and energy sectors highlights that the evasion technique is paired with serious operational malware aimed at critical infrastructure. This matters because as AI becomes embedded in SOC workflows, adversaries will increasingly probe and exploit the boundaries of those tools.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
- malware — MATCHBOIL
- malware — GuardBreaker