Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis

UAC-0099's GuardBreaker Tactic

The Russia-aligned threat actor UAC-0099 has introduced a sophisticated method, dubbed GuardBreaker, to subvert artificial intelligence (AI) systems used in cybersecurity analysis. This technique involves embedding problematic text, such as a request for instructions on building a nuclear weapon, within malicious VBScript files. The explicit aim is to trigger the safety protocols of Large Language Models (LLMs) or other AI analysis tools. By provoking a refusal or confusion state in the AI, the attackers hope to prevent the tool from scrutinizing the rest of the malicious code, thereby allowing their payloads to be deployed without detection.

This tactic is particularly concerning given UAC-0099's history of targeting critical sectors like transportation and energy. The GuardBreaker-embedded script is part of a larger arsenal, often serving as a loader for a C#-based tool called MATCHBOIL, which is exclusively used by this actor to download and install further malicious payloads. This sophisticated approach underscores a growing trend of adversaries actively seeking to exploit the inherent safety mechanisms of AI, turning them into potential blind spots for defenders.

Previous Adversarial Prompt Injection

This is not the first instance of attackers leveraging adversarial prompt injection to bypass AI-assisted security workflows. Earlier in 2026, similar tactics were observed in supply chain attacks involving Python packages, such as the Mini Shai-Hulud campaign. These attacks also embedded fake text related to sensitive topics like nuclear weapons to trip AI safety guardrails, forcing security scanners into a refusal state. The goal was to derail scanners or AI copilots that feed file beginnings to language models without properly isolating untrusted data, leading to confusion, context pollution, or premature classification before the actual malware could be identified.

While initial waves of these attacks were linked to the cybercrime group TeamPCP, attribution became more complex after the public leak of the Shai-Hulud worm's source code. This leak enabled other threat actors to adopt similar evasion techniques. More recently, the npm package @7nohe/openapi-react-query-codegen was compromised, delivering an obfuscated JavaScript loader that targeted cloud credentials, package registry secrets, GitHub Actions secrets, and AI agent configurations, further demonstrating the evolving nature of these supply chain compromises.

Evolving Threat Landscape and Attribution Challenges

The arrests of two alleged TeamPCP members, Ruben Ian Thomson and Louis Michael Gaebler, in Australia for their involvement in supply chain attacks, identity crime, and money laundering highlight the tangible consequences of these operations. TeamPCP, believed to be active since 2020, initially focused on opportunistic exploitation, but evolved to target vulnerability scanners within build pipelines, recognizing the wealth of credentials these tools possess. This transitive trust in security tooling is a critical vulnerability that attackers are increasingly exploiting.

The public leak of the Shai-Hulud worm's source code has significantly complicated attribution efforts, allowing various threat actors to adopt and adapt these sophisticated evasion techniques. This diffusion of advanced tactics makes it harder for security researchers to track specific groups and understand their evolving methodologies. The continuous innovation in malware design, particularly in its ability to deceive AI defenses, necessitates a parallel evolution in AI security tools and a robust understanding of adversarial tactics to maintain effective cyber defenses.