Russia-aligned threat actor UAC-0099 has deployed a novel evasion technique called GuardBreaker that embeds nuclear weapon-related prompts into malware payloads. The tactic forces large language models to refuse analysis, effectively blocking AI-powered security tools from examining the malicious code.
ESET researchers documented the attack against a Ukrainian target. The technique exploits how LLMs handle sensitive topics by injecting prompts that trigger safety guardrails built into systems like ChatGPT, Claude, and similar models. When security analysts feed suspicious files or code samples to AI assistants for rapid analysis, the embedded nuclear weapon references cause the AI to refuse engagement. This stalls threat investigation and gives attackers breathing room to refine or redeploy their tools.
GuardBreaker represents a calculated escalation in adversary sophistication. Instead of targeting detection engines directly, UAC-0099 targets the human workflow. Security teams increasingly rely on LLM-assisted analysis to quickly triage threats, generate reverse engineering insights, and identify indicators of compromise. By poisoning this analysis chain, the attacker introduces friction into incident response. Even a 30-minute delay in understanding malware behavior can matter operationally.
UAC-0099 operates from Russia-aligned infrastructure and focuses heavily on Ukrainian targets, particularly government and critical infrastructure sectors. Prior campaigns from this group have deployed wiper malware and destructive payloads consistent with state-sponsored objectives. The GuardBreaker technique fits this profile. Ukraine faces continuous pressure from Russian cyber operations, and this represents a tactical adjustment to target the tools defenders now use.
The risk extends beyond Ukraine. Any organization using AI-assisted malware analysis faces exposure. Security operations centers that outsource initial triage to LLMs risk incomplete assessments. Threat intelligence teams sharing suspicious artifacts with ChatGPT or similar platforms encounter friction when samples contain these embedded prompts. Smaller organizations without deep reverse engineering capability depend more heavily on AI assistants, making them particularly vulnerable to workflow disruption.
This technique also reveals a gap in LLM safety design. Guardrails work by refusing to engage with sensitive prompts. But when an attacker controls both the prompt and the payload, they can weaponize those same safeguards. The malware becomes a Trojan horse for prompt injection. It's unclear whether major LLM providers have updated their systems to flag or ignore this specific attack pattern.
Organizations should implement these defenses immediately. First, isolate LLM-assisted analysis from production environments. Never feed suspicious malware or code directly to public AI services. Use dedicated sandboxing and on-premise malware analysis tools as primary workflows. Second, document LLM limitations within security procedures. Analysts should not treat an LLM refusal as confirmation of legitimacy. Third, monitor for GuardBreaker signatures in incoming samples. Security vendors are already adding detection.
ESET's disclosure follows a broader trend of attackers targeting the security toolchain itself. Malware now targets endpoint detection and response agents, cloud security posture management platforms, and now AI-powered analysis services. Defenders must treat their tools as attack surfaces.