Russian Hackers of UAC-0099 Weaponize AI Guardrails as Evasion Tactic

On August 31, 2026, ESET disclosed an evasion technique: UAC-0099 hackers, a Russian group affiliated with the GRU, embed nuclear weapon requests in malicious VBS scripts to trigger LLM safety filters and halt analysis of the actual code. The technique, dubbed GuardBreaker, exploits the over-alignment of AI models: safety filters trained to refuse CBRN (chemical, biological, radiological, nuclear) content interrupt the entire scan instead of continuing to inspect the payload.

The incident, documented in Ukraine, directly challenges the assumption that drove mass adoption of AI scanners for automated malware analysis: that the ethical safety of large language models would automatically translate into operational security. The source proves the opposite.

How GuardBreaker Works: Code That Never Runs Stops Code That Gets Analyzed

The mechanism is architecturally simple. The VBS script contains a comment — text ignored by the interpreter during execution — that simulates a request for assistance in creating a nuclear weapon. Safety filters in language models, trained to refuse CBRN content, detect the keywords and trigger a refusal. The analysis stops, and the rest of the script, the part with the malicious logic, is never examined.

The comment serves no function in the code. It is a purely semantic element, inserted to be read by the AI, not the interpreter. This separation between execution flow and analysis flow is the vulnerability GuardBreaker exploits: safety filters are designed to protect the user from content generated by the model, not to assess the operational risk of an incoming file.

The real payload is MATCHBOIL: malware used exclusively by UAC-0099. The script downloads and installs it. Its effectiveness depends on the ability to pass unnoticed during automated analysis.

UAC-0099: The Group Between Sandworm and Ukrainian Critical Targets

UAC-0099 is described as a "Russia-aligned, previously observed conducting initial-access operations and handing validated targets to the GRU-linked Sandworm hackers." The phrasing does not establish an absolute identity with Sandworm: it indicates an operational relationship, a sharing of infrastructure and targets.

The group focuses on transport and energy sectors. CERT-UA had already documented the full infection chain — LUNCHPOKE, BURNYBEAR, MATCHBOIL.V2 — in a July advisory, confirming the tactic is part of a structured playbook.

The source does not specify whether GuardBreaker has been observed in more samples beyond the documented VBS script, nor whether the technique succeeded in a real operational environment or only in retrospective analysis.

The Previous Hades: Same Technique, Different Actors, Same Architectural Flaw

In June 2026, a campaign dubbed Hades had already used comments with biological and nuclear weapon requests in Python and JavaScript packages on public repositories. According to Tom's Hardware, reporting on Socket.dev analysis, the technique triggered "failsafe" mechanisms in tests with Anthropic Fable, showing "Chat paused" instead of completing the scan. The associated numbers — approximately 37 estimated Python packages and 106 estimated JavaScript packages — refer to Hades, not UAC-0099.

The technical convergence is significant: two distinct groups, with different objectives, identified the same structural weakness in LLM safety filters. The more models adopt alignment based on categorical refusal, the more the attack surface expands.

What to Do Now

For security analysts using AI scanners for automated malware analysis, the ESET detection mandates three specific operational adjustments for the GuardBreaker case.

First: verify that automated analysis tools do not halt scanning at the first refusal on CBRN content. The documented behavior — interruption of the entire analysis — is the failure point the VBS script exploits. Configure workflows to isolate refused segments and proceed with analysis of the rest of the file.

Second: supplement AI analysis with behavioral detection on VBS scripts contacting external endpoints. MATCHBOIL is known to ESET as malware exclusive to UAC-0099; its signature and the LUNCHPOKE-BURNYBEAR-MATCHBOIL.V2 chain documented by CERT-UA must be fed into reputation-based detection systems.

Third: treat comments with CBRN keywords in executable files as anomaly indicators, not as content to filter ethically. The distinction between a genuine request to an LLM and adversarial injection in malicious code is the context level current safety filters cannot apply autonomously.

"This case confirms what we at ESET have been saying for years. AI and machine learning can be valuable tools in security, but they cannot be trusted blindly or treated as silver bullet for every possible threat." — Juraj Janosik, VP of Artificial Intelligence at ESET

The Key Quote: Layered Defense as the Only Antidote

Juraj Janosik, ESET VP of AI, specified the defensive structure: "If AI-assisted analysis is not backed by multilayered detection approach, expert-driven research, behavioural analysis, reputation systems, sandboxing, heuristics, telemetry, and strong human-driven engineering, attackers will look for ways to manipulate or bypass it." The source presents these components as necessary, cumulative conditions.

The energy and transport sectors, UAC-0099's declared targets, are directly exposed because over-reliance on AI summarization for malware analysis reduces response time but increases detection fragility.

The discovery date coincides with publication, August 31, 2026. It is not known when the technique was first observed in the wild, nor how long it remained active before detection.

Questions and Answers

Is the nuclear comment executed by the malware?

No. The comment is text ignored by the VBS interpreter; its function is semantic, directed at AI analysis models, not executable.

Has GuardBreaker been used in other campaigns besides UAC-0099?

The source does not specify. The similar technique in Hades (June 2026) involves different actors, infrastructure, and targets; it is not documented as an extension of GuardBreaker.

Which AI scanners are vulnerable?

The source does not identify specific model, vendor, or version. The theoretical mechanism applies to LLMs with safety filters based on CBRN content refusal, but the ESET detection does not quantify the actual attack surface.

Information is based on the cited source and current as of publication.

Sources

• https://www.helpnetsecurity.com/2026/08/31/russian-hackers-ai-safety-filters-manipulation/
• https://www.tomshardware.com/tech-industry/cyber-security/hades-malware-campaign-now-tricks-ai-bots-by-injecting-text-about-biological-and-nuclear-weapons-failsafe-mechanisms-triggered-by-prompts-for-weapon-creation-stop-scans-before-payload-is-seen
• https://www.callmissed.com/blog/bypassing-the-guardrails-how-malware-authors-use-nuclear-and-biological-weapon-t
• https://www.helpnetsecurity.com/2025/02/13/sandworm-apts-initial-access-subgroup-hits-organizations-accross-the-globe/
• https://thehackernews.com/2026/08/apt28-linked-hookedge-backdoor-targets.html
• https://www.helpnetsecurity.com/2026/08/05/ai-agent-deception-in-cyber-tests/
• https://thehackernews.com/