UnclassifiedIdeologyIntermediate sophistication
UAC-0099
UAC-0099 is a Russia-attributed threat actor group with an ideological motive, tracked by Brandefense. It targets 8 sectors, including Government and Technology, in 3 countries, including Ukraine and Denmark. It uses 17 MITRE ATT&CK techniques.
- Origin
- Russia
- Techniques
- 17
- Exploited CVEs
- No CVE data
- Record updated
Who They Target.
How They Operate · MITRE ATT&CK.
17 techniques across 6 of 14 tacticsVulnerabilities Linked To Their Tools.
Browse Vulnerability Intelligence →Arsenal · Malware And Tools.
- BPFDoormalware
- BurnyBearmalware
- DRAGSTAREmalware
- LONEPAGEmalware
- LunchPokemalware
- MATCHBOILmalware
- MATCHWOKmalware
- PteroBoxmalware
- PteroDespairmalware
- PteroGraphinmalware
- PteroQuarkmalware
- PteroSandmalware
- PteroStewmalware
- PteroTicklemalware
- Eziriz .NET Reactortool
- Notepad++tool
- WinRARtool
Campaigns.
- UAC-0099 MATCHBOIL and MATCHWOK Espionage Campaign
- UAC-0099 MATCHBOIL Espionage Campaign
About UAC-0099.
A threat actor first documented in June 2023, known for targeting Ukrainian entities for espionage purposes. Identified as a state-aligned cyber espionage group.
Last updated Oct 8, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.