UAC-0099 Hides a Fake Nuclear Threat in Malware to Break AI Analysis Tools

Key points

• ESET has named a new technique called GuardBreaker, used by the Russia-aligned group UAC-0099 against a target in Ukraine.
• The attackers hide instructions inside their malware that try to trigger the safety filters of AI assistants used by security analysts.
• One decoy message pretends to describe a nuclear weapon, a topic most large language models refuse to discuss.
• Refusing to answer becomes a denial-of-service against the analyst, not a breach of the AI.
• GuardBreaker is a variation on prompt injection, a known weakness where hidden text hijacks a model's behaviour.

A Russia-aligned hacking crew has found an unusual way to slow down the people chasing them: make their malware so upsetting that an AI refuses to read it.

The group is tracked as UAC-0099, and researchers at Slovak security firm ESET say they spotted the trick in an attack aimed at a target in Ukraine. ESET is calling the technique GuardBreaker. The original reporting comes from The Hacker News, drawing on a series of posts ESET published on X. We first covered UAC-0099 on 23 July 2026; this is the second time the group has appeared in our reporting.

What is GuardBreaker actually doing?

It plants deliberately shocking text inside malicious files so that any AI assistant asked to analyse them refuses. The AI's own safety rules become the weapon.

Security analysts increasingly paste suspicious code into a large language model (an AI system like ChatGPT or Claude that reads text and explains what it sees). The AI then summarises what the code does, a huge time-saver when you're staring at thousands of lines of obfuscated script.

UAC-0099 has noticed. In at least one sample tied to the group, the malware contains a chunk of text pretending to be instructions for building a nuclear weapon. That's exactly the sort of content every mainstream AI model is trained to refuse outright. When an analyst drops the file into their AI helper, the model sees the nuclear content, hits its safety brakes, and bails out. The human is left to read the code the old-fashioned way.

Is this a new kind of AI attack?

Not really. It's a clever variation on prompt injection, where an attacker hides instructions inside content the AI reads, hoping the model follows those instructions instead of the user's.

The closest classic-security analogy is a poisoned document that trips an antivirus scanner into quarantining itself. The attacker isn't breaking the tool. They're getting the tool to break its own workflow.

What's genuinely new is the target. GuardBreaker isn't trying to make the AI leak secrets or run commands. It's trying to make the AI say no. As we noted on 26 August 2026 in our look at AI malware claims, attackers probing AI tools don't always need a sophisticated exploit: sometimes a cheap trick aimed at the analyst's workflow is enough.

Who is UAC-0099?

UAC-0099 is a group Ukraine's cyber defenders have tracked for a couple of years, generally going after Ukrainian government bodies and defence-linked organisations with phishing emails, fake messages designed to trick staff into opening malicious attachments.

The group is considered Russia-aligned. Its tooling tends to be workmanlike rather than flashy, which makes the GuardBreaker wrinkle interesting: it suggests the crew is watching how defenders now work, not just the defenders' software.

Should you worry about this?

Treat AI assistants like any other tool that can be fed hostile input. If your analysts use an LLM to triage malware samples, assume attackers will try to steer or silence it.

Strip or sandbox suspicious strings before handing a sample to a model. Keep a fallback for when the AI refuses, so an analyst isn't stuck. Log refusals as a signal worth reviewing rather than a dead end.

GuardBreaker is a small trick. It also points at where this is heading. As AI creeps into the security workflow, attackers will keep looking for cheap ways to poke it in the eye. The interesting question isn't whether this works today; it's how quickly defenders update their AI triage pipelines to treat a refusal the same way they'd treat a crash.