Russian-aligned hackers, identified as the cyberespionage group UAC-0099, have intensified their cyberattacks against Ukraine's transportation, manufacturing, and energy sectors. According to research by Slovak cybersecurity firm ESET, these attacks utilize an evolving malware strain known as MatchBoil, which is deployed to extract system data from targeted organizations. ESET's findings indicate that all detected infections have occurred within Ukraine. The deployment of MatchBoil was first noted by Ukraine's computer emergency response team, CERT-UA, in August 2025, though evidence points to its development starting as early as July 2024. The malware is typically introduced to systems via phishing emails containing malicious links, which download an archive that executes the malware. Once operational, MatchBoil can gather information about the infected system, download further malware, and establish persistence. ESET reports that the malware has been observed at transportation companies in mid-2025, a manufacturing firm by December of the same year, and an energy company by June 2026. The sophistication of MatchBoil has increased with each version, making it harder for security systems to detect. This suggests its significance in UAC-0099's operations, as they continue to refine it for future use. Despite these advancements, some attempts at deception, such as a fake daily planner application, have been less convincing. UAC-0099 has been active since at least 2022, with CERT-UA first reporting on the group in June 2023. The hackers have primarily targeted Ukrainian governmental bodies, financial sectors, and media, previously employing tactics like phishing emails disguised as court summonses to deploy additional malware such as the MatchWok backdoor and the Dragstare information stealer. The total number of affected entities remains undisclosed by both ESET and CERT-UA.