The corporate security world has shed its illusions regarding the absolute reliability of digital signatures and trusted software. Recent incidents involving the UAC-0099 group demonstrate that attackers are increasingly abandoning complex zero-day exploits in favor of software supply chain attacks. By using modified versions of legitimate, everyday tools, attackers bypass classic perimeter defense systems.
For CISOs and IT directors of critical infrastructure enterprises, this necessitates a paradigm shift. When malicious code executes within the context of a trusted process, standard antivirus software and Endpoint Detection and Response (EDR) sensors remain blind. Defense must be built on the assumption that a workstation may already be compromised, with strict program execution control and critical data isolation becoming the primary lines of defense.
Anatomy of a threat: why UAC-0099 chooses legitimate software over classic exploits
The UAC-0099 group focuses on attacks against government agencies and the defense sector of Ukraine. Their tactics prioritize maximum camouflage as everyday system administrator activity. Instead of attempting to breach the firewall from the outside, attackers deliver malicious payloads directly to workstations within the network.
A striking example is the use of modified versions of the popular text editor Notepad++ or legitimate VPN clients. The user downloads an installer that is visually and functionally identical to the original. However, malicious activity unfolds in the background. According to SOC Prime analysts, UAC-0099 attacks actively employ specific malware families: MATCHBOIL, MATCHWOK, and DRAGSTARE.
Similar methods are used by the UAC-0145 group. As reported by CERT-UA, during a fictitious employment process, candidates are sent modified VPN clients, allowing attackers to bypass standard authentication protocols and gain initial network access. According to trends reflected in the ENISA Threat Landscape 2025 report, supply chain attacks are a critical vector: up to 27.7% of incidents are linked to the compromise of trusted connections, and over 53.7% of organizations face serious difficulties in detecting such anomalies.
The trap of blind trust: why antivirus software misses attacks via signed utilities
The main weakness of traditional Endpoint Protection (EPP) tools lies in a trust-based model. If a file has a legitimate digital signature or runs from a system directory, the security system lowers its verification level. Attackers exploit this through dynamic library loading techniques (DLL Side-Loading or DLL Hijacking).
The mechanism of the attack is as follows:
- A legitimate executable initiates the loading of required dynamic libraries (.dll) upon startup.
- Attackers place their own malicious DLL in the same folder as the main process or modify the program's configuration files.
- The operating system loads the malicious DLL into the address space of the trusted process.
- All actions (network requests, registry reads, script execution) are performed on behalf of the legitimate process (e.g., Notepad++), which does not trigger signature-based scanners.
As a result, malware (such as MATCHBOIL) can silently establish a foothold in the system, execute unauthorized PowerShell scripts, or perform lateral movement in search of databases.
Architectural response: Zero Trust and application whitelisting on endpoints
In accordance with Microsoft's access management recommendations, localizing the consequences of a compromise requires the implementation of a Zero Trust architecture ("never trust, always verify") and the principle of least privilege. The first step is transitioning to application whitelisting.
For Windows OS, the industry standard is Windows Defender Application Control (WDAC) or AppLocker. Key architectural steps include:
- Allowing binary files to run only from protected system directories that are writable exclusively by administrators.
- Strict DLL control: WDAC allows for the activation of code integrity mode, where every library is verified against publisher rules before loading.
- Activating Constrained Language Mode for PowerShell, which blocks the execution of complex scripts and Win32 API calls for standard users.
Segmentation and data isolation: how to protect the corporate core
Even with strict WDAC policies, the risk of compromising an individual PC remains. Infrastructure resilience is determined by the ability to prevent a local incident from becoming a catastrophe. To minimize the blast radius, network micro-segmentation is essential.
Critical business systems and data repositories should not be directly accessible from the general office network. Access must occur exclusively through conditional access policies with mandatory device compliance checks and multi-factor authentication (MFA).
Built-in security of the UnityBase platform as a data defense line
When a workstation is already compromised via a rogue VPN client, the final line of defense remains the security of the application software itself. Corporate applications must have their own protection mechanisms, independent of the endpoint's state. An example of a technological foundation with this approach is the UnityBase platform, a joint development of the Intecracy Group alliance (where InBase acts as a key developer). Intecracy Group is an alliance of independent companies linked by partner agreements and share exchanges — not a single company, not a holding.
Solutions in the ECM/DMS class (e.g., Megapolis.DocNet, Scriptum.DMS) and government registries are built on the UnityBase platform. Even if an attacker's local PC is integrated into the network, the UnityBase architecture blocks attempts at lateral movement to critical data through built-in mechanisms:
- Server-side validation and data isolation: All business logic executes on the application server. The client-side in the browser is merely a UI. Attempts at API manipulation by a compromised client are automatically rejected at the server level.
- Role-Based Access Control (RBAC) and Row-Level Security (RLS): Commercial editions of the platform strictly segregate access. A compromised account will not be able to access data or functions that exceed its daily, least-privilege requirements.
- Audit Trail: Every action—from viewing a document to attempting an export—is recorded in a secure log. These records cannot be altered from the client side, ensuring reliable incident investigation.
Synchronizing Zero Trust policies at the workstation level with strict access control at the UnityBase platform level creates a layered defense capable of localizing attacks by modern APT groups.
Workstation defense matrix against software supply chain attacks
| Threat level | Attack method (example) | Technological countermeasure |
|---|---|---|
| Initial access | Modification of legitimate software (e.g., VPN, text editors) | File integrity control, WDAC, blocking unauthorized DLLs |
| Code execution | Running malicious scripts (MATCHBOIL) via trusted processes | Constrained Language Mode (PowerShell), blocking system utility calls by applications |
| Lateral movement | Exploitation of trusted connections and sessions within the perimeter | Network micro-segmentation, Zero Trust Network Access, MFA |
| Data exfiltration | Attempted access to registries/ECM from a compromised PC | Role-based access (RBAC/RLS) at the platform level (UnityBase), API auditing |
FAQ
How can one detect that a legitimate program (e.g., a text editor or VPN) has been modified by attackers?
Key signs of modification include: a mismatch between the installer's hash sums and official releases, the absence of a valid digital signature from the developer on associated DLL files, and anomalous network activity by the process (e.g., attempts to establish connections with unknown external IP addresses).
Why does standard antivirus (EPP) often fail to block the execution of malware like MATCHBOIL or DRAGSTARE?
These types of malware use DLL Side-Loading techniques. Since the malicious code is loaded and executed within the address space of a trusted process (which has a valid signature or is on the antivirus whitelist), the system perceives its activity as legitimate.
Which WDAC or AppLocker settings are critical for protection against such attacks?
It is necessary to prohibit the execution of any binary files and scripts from directories where a standard user can write data (e.g., %LocalAppData% or %Temp%). Publisher Rules should be used instead of path rules, allowing only applications signed by verified certificates to run.
Data sources
- cert.gov.ua: Повідомлення про порушення" від UAC-0099 (CERT-UA#12463)
- socprime.com: UAC-0099 Attack Detection: Hackers Target Government and Defense Agencies in Ukraine Using MATCHBOIL, MATCHWOK, and DRAGSTARE Malware | SOC Prime
- CERT-UA: Соціальна інженерія у виконанні UAC-0145: компрометація у процесі працевлаштування
- ENISA Threat Landscape 2025
- Microsoft: Zero Trust identity and access management