UAC-0099 Hides a Fake Nuclear Threat in Malware to Break AI Analysis Tools

Key points

• Researchers at ESET have named a new trick called GuardBreaker, used by the Russia-aligned group UAC-0099 against a target in Ukraine.
• The attackers hide instructions inside their malware that try to trigger the safety filters of AI assistants used by security analysts.
• One decoy message pretends to describe a nuclear weapon, a topic most large language models refuse to discuss.
• The goal is not to hack the AI, but to make it refuse the job, slowing down human investigators.
• The technique is a fresh spin on prompt injection, a known weakness in AI systems where hidden text hijacks a model's behaviour.

A Russia-aligned hacking crew has come up with an unusual way to slow down the people chasing them: make their malware so upsetting that an AI refuses to read it.

The group is tracked as UAC-0099, and researchers at Slovak security firm ESET say they spotted the trick in an attack aimed at a target in Ukraine. ESET is calling the technique GuardBreaker.

The original reporting comes from The Hacker News, drawing on a series of posts ESET published on X.

What is GuardBreaker actually doing?

It is planting deliberately shocking text inside malicious files so that any AI assistant asked to analyse them refuses. The AI's own safety rules become the weapon.

Here is the setup. Security analysts increasingly paste suspicious code into a large language model, meaning an AI system like ChatGPT or Claude that can read text and explain what it sees. The AI then summarises what the code does. It is a huge time-saver when you are staring at thousands of lines of obfuscated script.

UAC-0099 has noticed. In at least one sample tied to the group, the malware contains a chunk of text pretending to be instructions for building a nuclear weapon. That is exactly the sort of content every mainstream AI model is trained to refuse outright.

So when an analyst drops the file into their AI helper, the model sees the nuclear content, hits its safety brakes, and bails out. The human is left to read the code the old-fashioned way.

Is this a new kind of AI attack?

Not really. It is a clever variation on prompt injection, where an attacker hides instructions inside content the AI reads, hoping the model will follow those instructions instead of the user's.

Probably the closest classic-security analogy is a poisoned document that trips an antivirus scanner into quarantining itself. The attacker is not breaking the tool. They are getting the tool to break its own workflow.

What is genuinely new is the target. GuardBreaker is not trying to make the AI leak secrets or run commands. It is trying to make the AI say no. Refusal as a denial-of-service, if you like.

Who is UAC-0099?

UAC-0099 is a group Ukraine's cyber defenders have tracked for a couple of years, generally seen going after Ukrainian government bodies and defence-linked organisations with phishing emails, meaning fake messages designed to trick staff into opening malicious attachments.

The group is considered Russia-aligned. Its tooling tends to be workmanlike rather than flashy, which makes the GuardBreaker wrinkle interesting: it suggests the crew is paying close attention to how defenders now work, not just to the defenders' software.

What should defenders take from this?

Treat AI assistants like any other tool that can be fed hostile input. If your analysts use an LLM to triage malware samples, assume attackers will try to steer or silence it.

A few practical responses:

• Strip or sandbox suspicious strings before handing a sample to a model.
• Have a fallback for when the AI refuses, so an analyst is not stuck.
• Log refusals as a signal worth reviewing, not just a dead end.

GuardBreaker is a small trick. It also hints at where this is heading. As AI creeps into the security workflow, attackers will keep looking for cheap ways to poke it in the eye.