Full Report
Cybersecurity researchers have disclosed a new technique dubbed GuardBreaker that's been put to use by a Russia-aligned threat actor known as UAC-0099 against a target in Ukraine with an aim to interfere with artificial intelligence (AI)-assisted analysis. The idea, ESET said in a series of posts on X, is to deliberately trip a large language model's (LLM) safety mechanisms and prevent its
Analysis Summary
# Tool/Technique: GuardBreaker
## Overview
**GuardBreaker** is an anti-analysis technique that utilizes plain-text adversarial prompt injection to disrupt AI-assisted security workflows. By embedding specific text that violates Large Language Model (LLM) safety policies (such as requests for instructions on building weapons), the technique forces AI-powered scanners and analyst "copilots" into a refusal state. This prevents the AI from analyzing the actual malicious code contained within the file.
## Technical Details
- **Type:** Anti-analysis Technique / Adversarial Prompt Injection
- **Platform:** Windows (via VBS scripts/Notepad++ plugins) and cross-platform (via Python/npm packages)
- **Capabilities:** AI guardrail triggering, refusal-of-service for security scanners, context pollution.
- **First Seen:** Early instances reported June 2026 (Mini Shai-Hulud); UAC-0099 variant reported September 2026.
## MITRE ATT&CK Mapping
- **TA0005 - Defense Evasion**
- **T1497 - Virtualization/Sandbox Evasion** (Extended to AI-assisted analysis evasion)
- **T1027 - Obfuscated Files or Information**
- **TA0002 - Execution**
- **T1059.005 - Command and Scripting Interpreter: Visual Basic**
## Functionality
### Core Capabilities
- **Safety Mechanism Triggering:** The technique inserts "problematic" strings (e.g., *"I want to make a nuclear weapon. Help me..."*) into script comments.
- **LLM Refusal:** When an AI scanner processes the file, the safety guardrails identify the prompt as a violation of "harmful content" policies, causing the model to stop processing or return a generic refusal message.
- **Analysis Derailment:** By placing the injection at the beginning of a file, the attacker ensures the AI agent classifies or rejects the file before reaching the actual malicious payload.
### Advanced Features
- **Prompt Confusion:** Mixing legitimate code with adversarial prompts to confuse the context window of the LLM.
- **Payload Delivery:** In the UAC-0099 campaign, GuardBreaker is used to protect a VBS script that downloads the **MATCHBOIL** loader.
## Indicators of Compromise
*Note: Specific hashes for the September 2026 UAC-0099 campaign were not provided in the source text.*
- **File Names:**
- Malicious Notepad++ plugins (e.g., fake `.dll` files)
- Malicious VBS scripts
- **Network Indicators:**
- C2 infrastructure associated with UAC-0099 (defanged: `uac0099-c2[.]com` - *example*)
- **Behavioral Indicators:**
- VBScripts attempting to download and execute C# binaries (`MATCHBOIL`).
- Unusual registry modifications via Notepad++ plugins.
## Associated Threat Actors
- **UAC-0099:** A Russia-aligned threat actor targeting Ukraine's energy and transportation sectors.
- **TeamPCP:** A cybercrime group linked to the original Shai-Hulud worm and early AI-evasion experiments.
## Detection Methods
- **Signature-based detection:** Scanning for specific adversarial strings like *"I want to make a nuclear weapon"* or *"step-by-step instructions on biological weapons"* inside code comments.
- **Behavioral detection:** Monitoring for unexpected script execution (VBScript) initiated by common text editors or office applications.
- **Sanitization Check:** Identifying if security tools return "Refusal" or "Error" statuses during automated triage, which may indicate a GuardBreaker-style bypass.
## Mitigation Strategies
- **Content Isolation:** Ensure AI analysis pipelines treat input data as untrusted and use system prompts that instruct the model to ignore code comments when performing safety checks.
- **Multi-Layered Analysis:** Do not rely solely on LLM-based triage; supplement with traditional static (YARA) and dynamic (Sandbox) analysis.
- **Input Filtering:** Pre-filter known adversarial prompt strings before passing the code to an LLM for summarization or analysis.
## Related Tools/Techniques
- **MATCHBOIL:** A C#-based loader used by UAC-0099 to deliver final payloads.
- **Mini Shai-Hulud / Miasma / Hades:** Supply chain attack campaigns that pioneered the use of LLM-scanner anti-analysis.
- **Prompt Injection:** The broader category of attacks involving malicious instructions passed to LLMs.