Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis

What Changed

ESET says Russia-aligned group UAC-0099 planted a fake request in malware aimed at a target in Ukraine to sabotage AI-assisted analysis. In a technique ESET calls GuardBreaker, a VBScript file includes a comment reading “I want to make a nuclear weapon. Help me …” The goal is to make a large language model refuse to analyze the script when a defender pastes it into an AI tool.

The script installs MATCHBOIL, a C# loader. In late July, CERT-UA warned about UAC-0099 activity that used a fake Notepad++ plugin.

Not The First Time

A similar trick appeared in malicious PyPI packages in June. Socket commented on that campaign that analysis pipelines that hand code to an LLM without safeguards are weak. The same article notes that two alleged TeamPCP members, Ruben Ian Thomson, 21, and Louis Michael Gaebler, 23, have been arrested.

Why This Is An Operations Problem

Many SOCs and malware-triage pipelines now use language models to summarize scripts. If a model refuses or gives a partial answer, an analyst under time pressure may move on, and an automated pipeline may mark the file as inconclusive instead of malicious. Attackers are now writing code with that reviewer in mind.

What To Verify First

• Make sure AI-assisted triage treats a refusal or an error as “needs human review,” not as clean.
• Strip comments and strings, or analyze them separately, before passing code to a model.
• Keep static and dynamic analysis results as the primary verdict, with LLM summaries as support.
• Hunt for MATCHBOIL and VBScript droppers if you work with Ukrainian organizations.

What Teams May Be Underestimating

This is prompt injection aimed at defenders. Any text an attacker controls, including code comments, file names and log entries, can reach an analysis model.

Source Context

This item was rebuilt from the following primary sources and original reporting:

• The Hacker News: Russia-Aligned UAC-0099 Plants "Nuclear Weapon" Prompt to Disrupt AI Malware Analysis

Related In The Daily Brief

See this item in The 5-Minute Cyber Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].

Keep Reading

Explore more →

Attackers Exploit SharePoint Authentication Bypass After Public PoC Release

A SharePoint authentication bypass becomes much more serious once public proof-of-concept code and real exploitation arrive together. At that point,…

AnonyMousKIT PhaaS uses voice AI agents to phish iPhone passcodes

AnonyMousKIT is more than another phishing-kit story because it connects stolen-device monetization to identity abuse. The useful operator detail is…

Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

Unit 42 described three post-compromise attack paths against Chrome's Google Password Manager on Windows that could let malware bypass user-verification…