Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
UAC-0099
AI-generated illustration
OrganisationRU

UAC-0099

CERT-UA designation for a Russia-aligned espionage group targeting Ukraine.

UAC-0099 is CERT-UA's designation for a cyberespionage group targeting Ukrainian organisations and assessed by ESET as aligned with Russian interests.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

Does every UAC-0099 foothold now risk a destructive Sandworm follow-up?

Timeline for UAC-0099

#15 21 Oct

Phished the grain firm and handed over its access

Cybersecurity: Threats and Defences: ESET ties Sandworm to Ukraine grain wipe
View full timeline →
Follow Cybersecurity: Threats and Defences →

Background

UAC-0099 is the designation used by Ukraine's computer emergency response team for a cyberespionage group targeting Ukrainian organisations. ESET assesses with medium confidence that the group is aligned with Russian interests. Its known activity includes phishing and the use of the MATCHBOIL downloader and MATCHWOK backdoor to establish access.

Researchers have also assessed a handoff from UAC-0099 to Sandworm in one observed intrusion. That finding supports an access-sharing relationship, but it does not show that every UAC-0099 foothold is transferred or becomes destructive.

Common Questions
Who is UAC-0099?
UAC-0099 is a cyberespionage group targeting Ukrainian organisations. ESET assesses with medium confidence that it is aligned with Russian interests.Source: ESET Research
How did UAC-0099 enter the Ukrainian grain company?
ESET says UAC-0099 used a spearphishing email with a malicious attachment on 16 July 2025, leading to execution of the MATCHWOK backdoor.Source: ESET Research
Why does ESET link UAC-0099 to Sandworm?
ESET assesses with high confidence that UAC-0099 handed its grain-company access to Sandworm before the destructive stage, but it could not identify which group mainly operated MythicRatatoskr.Source: ESET Research
What malware does UAC-0099 use?
ESET and CERT-UA associate UAC-0099 with the MATCHBOIL downloader and MATCHWOK backdoor. A backdoor gives remote access; it is distinct from the later data-wiping malware stage.Source: ESET Research
Source Material
UAC-0099 cyberespionage against Ukrainian state organisations and media representativesRussian-aligned UAC-0099 intensifies attacks on Ukrainian industry with evolving MATCHBOIL downloaderMythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.