UAC-0099 hides nuclear-weapons prompt in malware to make AI analysis refuse it

Russia-aligned group UAC-0099 is targeting Ukrainian government and logistics organizations with a new .NET trojan called ASHVEIN. A VBScript embedded in the payload contains a prompt asking for nuclear weapons instructions, designed to trigger an LLM's safety refusal and stop it from analyzing the malicious code. Researchers call the technique GuardBreaker.

• UAC-0099 delivers the ASHVEIN trojan via decoy documents and DLL sideloading
• The VBScript embeds a nuclear-weapons prompt to trigger an LLM refusal
• Goal is not the instructions but to block AI analysis of the malware
• Traditional AV and YARA rules do not detect this technique