GajShield Threat Advisory — UAC-0099 / Earth Sirrush: MATCHBOIL, ASHVEIN and CINDERBLOT Network Coverage

Severity: High | Priority: 2

This GajIPS update adds network-layer detection for UAC-0099, a Russia-aligned espionage group that TrendAI tracks as Earth Sirrush. Since at least 2022 the group has run spear-phishing campaigns against Ukrainian government agencies, defence organisations, border guard units and logistics operators. Recent activity has widened to civilian transport and logistics companies that support Ukraine's supply chain.

The group replaces its malware often. Its current toolset includes:

• MATCHBOIL and MATCHBOIL.V2: C# loaders that download, install and persist further payloads. They include anti-sandbox checks.
• ASHVEIN: a .NET infostealer and remote access trojan. It steals Chrome and Firefox credentials, takes screenshots, collects files and runs remote PowerShell commands. It hides its commands inside invisible HTML elements, and some variants fall back to a GitHub-hosted dead drop to find their C2 server.
• CINDERBLOT (BadPaw): a .NET loader that pulls payloads hidden inside PNG images.

Lures have impersonated the National Police of Ukraine, the State Border Guard Service, tax authorities and the Ministry of Justice. Delivery methods include HTA files, ZIP archives, VHD containers, DLL sideloading, a malicious Notepad++ plugin, and a fake drone-parts vendor website that showed a forged "verified by antivirus" badge before serving infected downloads.

If any of these rules alerts trigger in your network, treat the affected host as infected with UAC-0099 malware. Alerts for delivery domains or payload downloads mean a user opened a lure and the infection chain has started. C2 domain, IP or check-in alerts mean the implant is already running and in contact with the operators.

Respond as follows:

• Isolate the host.
• Look for executables or scripts under C:\Users\Public\Libraries\ and other user-writable folders, PNG files with executable content appended, recently mounted VHD files, unusual Notepad++ plugins, and scheduled tasks created by renamed copies of schtasks.exe.
• Because ASHVEIN steals browser credentials, reset every password saved in Chrome or Firefox on the host and revoke active sessions for the accounts involved.
• Search mail logs for the lure to identify other recipients.