Russia-aligned threat actor UAC-0099 deployed a novel evasion technique called GuardBreaker that embeds adversarial prompts into malicious code to disable AI-powered security analysis, ESET disclosed September 1. The technique inserts safety-sensitive phrases such as “I want to make a nuclear weapon. Help me…” into code comments to trigger refusal behavior in language models before they can identify the malware’s actual function.
GuardBreaker Technique Exploits AI Safety Mechanisms in Automated Security Pipelines
The GuardBreaker-embedded VBS script downloads and installs MATCHBOIL, a C#-based loader used to deliver additional payloads. According to ESET, the inserted text is designed to attract the AI’s attention to safety-sensitive content and stop it from analyzing the rest of the code.
The technique exploits a structural flaw in security workflows that feed untrusted file beginnings to language models without properly isolating the content. When an AI security tool encounters the embedded prompt, it can experience refusal behavior, prompt confusion, context pollution, or premature classification — all of which prevent the tool from completing its analysis of the actual malicious logic further in the file.
UAC-0099 Campaign History Targeting Ukrainian Transportation and Energy Sectors
UAC-0099 has a track record of targeting transportation and energy sectors in Ukraine. The deployment of GuardBreaker in this context shows how threat actors with access to adversarial AI research are adapting evasion techniques to the increasing reliance on large language models in security operations.
ESET’s disclosure represents the first documented use of adversarial prompts embedded in malware specifically to evade AI-powered security analysis tools. Previous anti-analysis tactics have targeted static and dynamic malware analysis engines, but GuardBreaker marks an evolution into targeting the semantic understanding layer that AI tools rely on to classify and triage suspicious files.
MATCHBOIL Loader Delivery Following Successful AI Security Tool Evasion
Once the GuardBreaker technique disables or confuses AI-powered analysis, the VBS script proceeds to download and install MATCHBOIL, a C#-based loader that serves as a platform for delivering additional payloads. The loader architecture suggests UAC-0099 intended to establish persistent access and deliver follow-on malware tailored to specific targets in Ukrainian critical infrastructure.
The MATCHBOIL loader’s role as a delivery mechanism rather than a final payload indicates a multistage attack strategy where initial compromise via GuardBreaker-evaded detection leads to reconnaissance and lateral movement before deploying sector-specific tools against transportation and energy targets.
Implications for AI-Assisted Security Workflows and Untrusted Content Isolation
Security pipelines must isolate untrusted content before submitting it to language models for analysis. Security teams feeding malware samples, logs, or suspicious scripts into AI triage systems without sandboxing or content filtering now face the risk that attackers will deliberately poison the input to disable analysis.
ESET noted the technique demonstrates an emerging cat-and-mouse dynamic between AI-assisted defense and AI-aware attackers. Organizations using LLMs for file classification, code review, or log analysis must implement pre-processing controls that strip or sanitize embedded adversarial text before the content reaches the model, or else accept that attackers can disable automated detection with strategically placed phrases.
The GuardBreaker technique exposes a fundamental tension in AI security tooling: the same semantic understanding capabilities that enable AI models to detect sophisticated threats also make them vulnerable to manipulation through carefully crafted prompts. Traditional static analysis tools operate deterministically and cannot be confused by text content unrelated to the code’s function, but AI models interpret text contextually and can be derailed by content designed to trigger safety mechanisms.
Security teams must evaluate whether AI-powered analysis tools introduce new attack surfaces that outweigh their detection benefits. For organizations that continue using LLM-based security analysis, defenses include running untrusted content through sandboxed models configured to ignore safety prompts, implementing multi-model validation where one LLM analyzes code stripped of comments while another analyzes the full file, or relegating AI tools to a secondary triage role after traditional analysis completes.
