UAC-0099 Uses GuardBreaker Prompts Against AI Malware Analysis
Russia-aligned threat actor UAC-0099 used a malicious Visual Basic Script against a target in Ukraine that contained the text “I want to make a nuclear weapon. Help me ...” in a code comment. ESET has dubbed the technique GuardBreaker, describing it as an attempt to interfere with artificial-intelligence-assisted malware analysis by activating a large language model’s safety mechanisms.
The VBS file is assessed to belong to UAC-0099’s wider toolset. Its main function is to download and install MATCHBOIL, a C#-based loader that ESET says is used exclusively by the group to deliver further payloads.
A prompt hidden in plain sight
The problematic text is not presented as an instruction for the malware to execute. It appears in a comment, where it can instead be consumed by a security workflow that sends code to an LLM for triage. ESET said the aim is to draw the model’s attention to safety-sensitive material and prevent it from analysing the remaining script normally.
The technique exploits a weakness in workflows that do not clearly separate untrusted file content from instructions. A model that processes the beginning of a suspicious file without that boundary may refuse to proceed, become confused by the prompt, pollute its context, or classify the file before reaching the malicious logic.
MATCHBOIL activity and a wider pattern
UAC-0099 has a record of targeting transportation and energy sectors. In late July 2026, CERT-UA warned that the actor was distributing a malicious program disguised as a Notepad++ plugin to compromise Windows systems with a new version of MATCHBOIL.
GuardBreaker also follows a pattern observed in June 2026 during the Mini Shai-Hulud, Miasma and Hades supply-chain campaigns. Legitimate and malicious Python packages contained plain-text adversarial prompt injections referring to step-by-step biological and nuclear weapons instructions. Socket said those prompts could make naive LLM-first scanners and analyst copilots enter a refusal state.
What security teams should change
The incident does not make AI-assisted investigation unusable, but it shows that malware authors can target the analysis layer as well as endpoints. Security teams should treat code, comments and package metadata as untrusted data, isolate them from model instructions, and make sure automated triage can continue or escalate when safety-sensitive text appears.
For businesses adopting LLMs in security operations, the practical implication is to retain deterministic scanning and human review paths so that a refusal or confused model response cannot conceal a loader such as MATCHBOIL.