Russia-Aligned UAC-0099 Plants Nuclear Weapon Prompt in Malware to Disrupt AI Analysis

Cybersecurity researchers have disclosed a new technique dubbed GuardBreaker that's been put to use by a Russia-aligned threat actor known as UAC-0099 against a target in Ukraine with an aim to interfere with artificial intelligence (AI)-assisted analysis. The idea, ESET said in a series of posts on X, is to deliberately trip a large language model's (LLM) safety mechanisms and prevent its

Reportedly, Russia-aligned threat actor UAC-0099 is using a technique called GuardBreaker that implants a crafted nuclear-weapon-related prompt in malware to deliberately trigger large language model (LLM) safety systems and disrupt AI-assisted analysis workflows. According to the report, the goal is not to control the model's output but to cause it to refuse processing, thereby blinding or degrading defenders’ automated triage and investigation capabilities. From a RealGround perspective, this represents an indirect prompt injection risk where hostile content embedded in artifacts (such as malware samples) is designed to interfere with downstream AI tools rather than exfiltrate data. Organizations relying on LLM-based analysis pipelines should implement continuous AI red teaming to detect such denial-of-analysis patterns, harden safety filtering logic, and ensure human-in-the-loop review paths when models are triggered into refusal states.