Fake Court Summons Phish Drops MatchBoil Malware

Researchers say the Russia-aligned group UAC-0099 has been phishing Ukrainian organizations with malicious links that install a data-harvesting malware called MatchBoil. The emails have included lures like fake Ukrainian court summonses, and clicking the link leads to downloading an archive that ultimately runs the malware. Victims observed include Ukrainian transport, manufacturing, and energy-sector organizations.

Key findings

• ESET links the MatchBoil malware to UAC-0099 and says observed infections were in Ukraine.
• MatchBoil is commonly delivered via phishing emails containing malicious links that download an archive and execute malware.
• CERT-UA previously reported UAC-0099 phishing emails disguised as Ukrainian court summonses.
• MatchBoil is used to profile infected machines and to deploy additional malware (e.g., backdoor and information stealer).
• ESET observed ongoing development to evade detection and improve victim deception (including a fake planner decoy in one variant).

Who’s being targeted

• Commonly targeted roles: All Employees, Operations/Transportation Staff, Energy Sector Staff, Manufacturing Staff, Legal, Executives, Government and Defense Personnel.
• Affected industries: Transportation, Manufacturing, Energy, Government, Finance, Media, Defense.
• Attack channels: email, website.
• Impersonated: A legitimate organization sending a document link (not specifically named), Ukrainian courts (court summons sender).

Awareness takeaways

• Treat unexpected “official document” emails as suspicious, especially when they push you to click a link to download files.
• Verify legal or court-related notifications through trusted, out-of-band channels before opening or following instructions.
• Assume attackers may use decoy documents or fake “legitimate” screens to reduce suspicion after a file is opened.

Red flags to watch for

• Unexpected email with a link to download an archive
• Message pushes you to click a link to view a document instead of using known official channels
• Downloaded file chain that leads to running an executable
• Unsolicited legal summons delivered by email
• Pressure/urgency implied by a summons
• Sender/address doesn’t match known official court communication channels