ESET researchers have documented the evolution of MATCHBOIL, a custom C# downloader used by the Russia-aligned UAC-0099 APT group. The malware downloads a payload from the group’s C&C server, installs it,