UAC-0099 'GuardBreaker' Attack: Russia-Aligned Actors Weaponize LLM Safety Filters to Blind AI-Assisted Malware Analysis — Detection and Defense Guide

ESET researchers have disclosed a novel anti-analysis technique — dubbed GuardBreaker — deployed by the Russia-aligned threat actor UAC-0099 against a target in Ukraine. The technique marks an inflection point in adversary tradecraft: instead of hiding malware from human analysts or traditional sandboxes, UAC-0099 is deliberately embedding content designed to trip the safety guardrails of large language models (LLMs) — including prompts referencing nuclear weapons — so that AI-assisted analysis pipelines refuse to process the sample at all.

This is not prompt injection for data theft. It is denial-of-analysis: the attacker weaponizes the defender's own AI safety alignment as an evasion mechanism. If your SOC, DFIR team, or MSSP pipeline uses LLM-assisted triage, summarization, or malware classification — and in 2026, most do — a single poisoned sample can silently remove that capability for the exact files you most need analyzed. Defenders must now treat LLM refusal events as a detection signal, not an inconvenience, and harden analysis pipelines against adversarial content crafted to trigger them.

Technical Analysis

What Happened

According to ESET's disclosure on X, UAC-0099 — a group with a documented history of targeting Ukrainian government and military entities — crafted malware containing embedded textual content specifically engineered to invoke an LLM's safety mechanisms. When an AI-assisted analysis tool ingests the file (for static summarization, string extraction review, code explanation, or report generation), the embedded nuclear-weapon-related prompt content causes the model's safety layer to decline the request, halting analysis.

Attack Chain (Defender's Perspective)

1. Delivery: UAC-0099 delivers a malicious payload to a Ukrainian target using established TTPs (the group has historically used spear-phishing and loader/backdoor families attributed to it by CERT-UA).
2. Poisoned Payload: The malware embeds coercive text — strings or comments referencing nuclear weapons and similarly prohibited topics — positioned where automated tooling will extract and submit it to an LLM (embedded strings, script comments, document text, or appended data blobs).
3. Guardrail Trip: When the SOC's AI-assisted analysis pipeline submits extracted content to the LLM, the safety classifier flags the nuclear/prohibited content and refuses the analysis.
4. Analytic Blindness: The sample fails silently or is logged as a routine refusal. Analysts never receive the AI-generated triage, the sample may be deprioritized, and the intrusion proceeds with degraded defender visibility.

Why This Is Dangerous

• It exploits trust in automation. Pipelines built on the assumption that an LLM will always return something now have an attacker-controllable failure mode.
• Refusals are rarely alerted on. Most LLM integrations treat safety refusals as benign operational noise, not as a high-fidelity indicator of adversarial manipulation.
• It scales trivially. Once a template of safety-tripping content is known to work against a given model, it can be appended to every payload at near-zero cost.
• It complements classic anti-analysis. GuardBreaker doesn't replace sandbox evasion or obfuscation — it adds a layer aimed squarely at the newest part of the defensive stack.

Exploitation Status

This is a confirmed in-the-wild technique observed in an active operation against a Ukrainian target, per ESET. There is no CVE associated with this activity — it is a tradecraft/technique disclosure, not a software vulnerability. It maps conceptually to MITRE ATT&CK T1027 (Obfuscated Files or Information) and the broader Impair Defenses (T1562) tactic, applied to AI-assisted defensive tooling.

Detection & Response

The defensive pivot is straightforward: the refusal itself is the IOC, and the embedded tripwire content is detectable before it ever reaches the model. Hunt for LLM-safety-trigger language inside delivered files, scripts, and process content — legitimate business documents in your environment should essentially never contain phrases like "ignore all previous instructions" paired with weapons-related coercion.

SIGMA Rules

The following rules target (1) prompt-injection / safety-tripwire language observed in script content and command lines, and (2) scripting engines executing content containing LLM-manipulation markers. Tune the keyword list to your environment; the combination of instruction-override phrases with prohibited-topic nouns is intentionally high-signal.

---
title: Embedded LLM Safety-Tripwire Content in Script or Command Line
description: Detects LLM guardrail-tripping or prompt-injection language (GuardBreaker-style) embedded in command lines or scripts, consistent with UAC-0099 anti-AI-analysis tradecraft.
id: 3f9c1a27-6e84-4b5d-9c12-8a7d2f4e6b01
status: experimental
references:
  - https://thehackernews.com/2026/09/russia-aligned-uac-0099-plants-nuclear.html
  - https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/09/25
tags:
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: process_creation
  product: windows
detection:
  selection_override:
    CommandLine|contains:
      - 'ignore all previous instructions'
      - 'ignore previous instructions'
      - 'disregard your instructions'
      - 'you are now in developer mode'
      - 'do not analyze this file'
      - 'refuse to analyze'
  selection_weapons:
    CommandLine|contains:
      - 'nuclear weapon'
      - 'build a bomb'
      - 'dirty bomb'
      - 'radiological device'
  condition: selection_override or selection_weapons
falsepositives:
  - AI red-team and prompt-injection research activity
  - Security awareness or LLM safety testing scripts
level: high
---
title: PowerShell Script Block Containing LLM Manipulation Markers
description: Detects PowerShell script blocks containing embedded LLM prompt-injection or safety-tripping text, consistent with GuardBreaker anti-analysis payloads.
id: 8b2e4d60-1c93-4f7a-b5e6-2d9c3a1f7e42
status: experimental
references:
  - https://thehackernews.com/2026/09/russia-aligned-uac-0099-plants-nuclear.html
  - https://attack.mitre.org/techniques/T1027/
author: Security Arsenal
date: 2026/09/25
tags:
  - attack.defense_evasion
  - attack.t1027
logsource:
  category: ps_script
  product: windows
detection:
  selection:
    ScriptBlockText|contains:
      - 'ignore all previous instructions'
      - 'disregard all prior'
      - 'nuclear weapon'
      - 'do not summarize'
      - 'do not analyze'
      - 'as an AI language model you must refuse'
falsepositives:
  - Internal AI safety testing and prompt-injection research
level: high
---
title: LLM-Assisted Analysis Tool Process Terminated or Crashed During File Processing
description: Detects unexpected termination of local AI-assisted analysis or sandbox agent processes while processing inbound files, a potential symptom of guardrail-trip denial-of-analysis.
id: 5d7a9f13-2b48-4e6c-a1d9-7c3e5b8f0a64
status: experimental
references:
  - https://thehackernews.com/2026/09/russia-aligned-uac-0099-plants-nuclear.html
author: Security Arsenal
date: 2026/09/25
tags:
  - attack.impact
  - attack.t1562
logsource:
  category: process_termination
  product: windows
detection:
  selection:
    Image|endswith:
      - '\triage-agent.exe'
      - '\sandbox-analyzer.exe'
      - '\llm-worker.exe'
      - '\ai-assistant.exe'
falsepositives:
  - Routine service restarts and updates
level: medium

Note: adjust the process names in the third rule to match your actual AI-analysis tooling. The intent is to alert when your analysis workers die or restart mid-queue — correlate with refusal-rate telemetry below.

KQL — Microsoft Sentinel / Defender

This hunt query looks for delivered files and process content containing GuardBreaker-style markers, and joins on recent inbound file events so you can pivot from a poisoned document to its delivery vector (email, download, removable media).

let TripwireTerms = dynamic(["ignore all previous instructions", "disregard all prior", "nuclear weapon", "build a bomb", "do not analyze", "do not summarize", "as an AI language model you must refuse", "developer mode enabled"]);
let SuspiciousProc =
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | where ProcessCommandLine has_any (TripwireTerms)
    | project ProcTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine;
let SuspiciousFiles =
    DeviceFileEvents
    | where TimeGenerated > ago(7d)
    | where FolderPath has_any ("\\Downloads\\", "\\Temp\\", "\\AppData\\", "\\InetCache\\", "\\Attachments\\")
    | where FileName endswith_any (".docm", ".xlsm", ".pdf", ".lnk", ".js", ".vbs", ".ps1", ".hta", ".iso")
    | project FileTime=TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName;
SuspiciousProc
| join kind=inner SuspiciousFiles on SHA256, DeviceName
| project FileTime, ProcTime, DeviceName, AccountName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName
| order by FileTime desc

Additionally, if your LLM analysis pipeline logs to Sentinel (via a custom log or App Insights), alert on refusal-rate anomalies — a spike in safety refusals clustered by submission source is your highest-fidelity GuardBreaker indicator:

// Refusal-rate anomaly for LLM-assisted analysis pipeline (adapt table/column names to your ingestion)
LLMAnalysis_CL
| where TimeGenerated > ago(14d)
| summarize Refusals = countif(Result_s =~ "safety_refusal"), Total = count() by bin(TimeGenerated, 1h), SourceSystem_s
| extend RefusalRate = todouble(Refusals) / todouble(Total)
| where RefusalRate > 0.15 and Refusals >= 3
| order by TimeGenerated desc

Velociraptor VQL

Use this artifact to sweep endpoints for recently created or modified files containing GuardBreaker-style tripwire strings — effective for finding the poisoned payload on disk even if execution telemetry was missed.

-- Hunt for files containing LLM safety-tripwire / prompt-injection markers (GuardBreaker)
LET terms = ['ignore all previous instructions', 'disregard all prior', 'nuclear weapon',
             'do not analyze this file', 'as an AI language model you must refuse', 'build a bomb']

LET hits = SELECT FullPath, Size, Mtime, Btime
FROM glob(globs=['C:/Users/*/Downloads/**', 'C:/Users/*/AppData/Local/Temp/**',
                 'C:/ProgramData/**'], accessor='file')
WHERE NOT IsDir
  AND Size < 50000000
  AND Mtime > now() - 604800
  AND ( read_file(filename=FullPath, length=2000000) =~ '(?i)ignore all previous instructions|disregard all prior|nuclear weapon|do not analyze this file|as an AI language model you must refuse|build a bomb' )

SELECT FullPath, Size, Mtime, Btime,
       hash(path=FullPath).SHA256 AS SHA256
FROM hits

Remediation / Verification Script

This PowerShell script scans high-risk locations (downloads, temp, attachment caches) for files containing GuardBreaker-style markers and exports findings with hashes for triage. Run it via your EDR/RCS at scale, and feed positive results into your IR queue.

# GuardBreaker tripwire scanner - scans user-writable inbound-file locations for LLM safety-tripwire markers
$ErrorActionPreference = 'SilentlyContinue'
$terms = @(
  'ignore all previous instructions',
  'disregard all prior',
  'nuclear weapon',
  'build a bomb',
  'do not analyze this file',
  'as an AI language model you must refuse',
  'developer mode enabled'
)
$pattern = ($terms | ForEach-Object { [regex]::Escape($_) }) -join '|'

$roots = @("$env:USERPROFILE\Downloads", "$env:TEMP", "$env:LOCALAPPDATA\Microsoft\Windows\INetCache", 'C:\ProgramData')
$exts  = @('.docm','.xlsm','.docx','.pdf','.js','.vbs','.ps1','.hta','.lnk','.txt','.rtf')
$cutoff = (Get-Date).AddDays(-7)
$results = @()

foreach ($root in $roots) {
  Get-ChildItem -Path $root -Recurse -File -ErrorAction SilentlyContinue |
    Where-Object { $exts -contains $_.Extension.ToLower() -and $_.LastWriteTime -gt $cutoff -and $_.Length -lt 50MB } |
    ForEach-Object {
      $content = Get-Content -Path $_.FullName -Raw -ErrorAction SilentlyContinue
      if ($content -and ($content -imatch $pattern)) {
        $hash = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash
        $results += [PSCustomObject]@{
          Path          = $_.FullName
          LastWriteTime = $_.LastWriteTime
          SizeBytes     = $_.Length
          SHA256        = $hash
          MatchedTerm   = ([regex]::Match($content, $pattern, 'IgnoreCase')).Value
        }
      }
    }
}

if ($results.Count -gt 0) {
  $out = "$env:ProgramData\GuardBreakerSweep_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
  $results | Export-Csv -Path $out -NoTypeInformation
  Write-Output "[ALERT] $($results.Count) file(s) with LLM safety-tripwire markers found. Results: $out"
  $results | Format-Table -AutoSize
} else {
  Write-Output '[OK] No GuardBreaker tripwire markers detected in scanned locations.'
}

Remediation

Because GuardBreaker is a tradecraft technique rather than a patchable vulnerability, remediation is architectural. Prioritize the following:

1. Treat LLM refusals as a detection signal, immediately. Every safety refusal generated during automated analysis of a submitted sample should open a ticket. Refusal rate, clustered by source, is your earliest GuardBreaker warning. Wire your pipeline telemetry into your SIEM today.
2. Never let a refusal end the analysis. Implement a fallback path: if the LLM refuses, the sample is automatically escalated to (a) deterministic/static tooling (YARA, capa, string analysis, disassembly), (b) a human analyst, and (c) a secondary model or an analysis-context-tuned endpoint. A refusal must raise priority, not drop it.
3. Sanitize and isolate LLM inputs. Strip or quarantine instruction-like text from extracted strings before submission. Submit structured artifacts (hashes, API calls, imports, behavioral summaries) rather than raw file content wherever possible — attackers cannot trip a guardrail with content you never send.
4. Use dedicated, safety-calibrated analysis models. Work with your AI vendor to provision an analysis-context deployment whose safety layer is tuned for defensive security workflows (malware, exploit, and adversarial-content review), rather than a general-purpose consumer model. Document and approve this configuration formally.
5. Harden against prompt injection generally. GuardBreaker is one payload in a broader class. Apply OWASP LLM Top 10 (LLM01: Prompt Injection) controls: input isolation, output validation, least-privilege tool access for the model, and no direct LLM-to-action pathways in your pipeline.
6. Threat-hunt for UAC-0099's conventional TTPs. The GuardBreaker payload still rides in on spear-phishing and loaders. Maintain CERT-UA and ESET IoC feeds for this actor, enforce macro/attachment controls, and ensure Ukrainian-facing or Eastern-Europe-adjacent business units receive heightened email scrutiny.
7. Update your IR playbooks. Add an 'AI-analysis integrity' check to malware triage: was this sample processed by the LLM pipeline? Did it produce a refusal? If yes, treat as potentially adversarially hardened and route to senior analysis.

The strategic lesson is one I've watched adversaries learn repeatedly over 15 years: every new layer of the defensive stack eventually becomes an attack surface. AI-assisted analysis is now that layer. The organizations that instrument, fallback-harden, and refuse-proof their pipelines in 2026 will be the ones that don't lose visibility exactly when the malware matters most.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub