ESET (WeLiveSecurity, 10 September 2026) says the Russia-aligned group UAC-0099 used a technique ESET calls GuardBreaker in the early stages of an attack against a target in Ukraine: a decoy request for guidance on building a nuclear weapon was inserted into the comments of a VBScript, so that an LLM-based code scanner's safety refusal would make it stop inspecting the rest of the file before reaching the malicious code. The script's purpose was to download and install MATCHBOIL, a loader used exclusively by this group to deliver additional payloads.

Do not treat this card as a TeamPCP reprise (already on Cyberstack as afp-teampcp-2026). (source: ESET WeLiveSecurity)

Correction (02 Nov 2026): removed The Hacker News as a source; removed details no other source gives. (source: ESET WeLiveSecurity)