Executive Summary
ESET reports Russia-aligned UAC-0099 used a technique called GuardBreaker against a Ukrainian target, planting a nuclear-weapon prompt in malware to trip LLM safety mechanisms and stop AI-assisted analysis.
What Happened
Cybersecurity researchers have disclosed a new technique dubbed GuardBreaker that's been put to use by a Russia-aligned threat actor known as UAC-0099 against a target in Ukraine with an aim to interfere with artificial intelligence (AI)-assisted analysis. The idea, ESET said in a series of posts on X, is to deliberately trip a large language model's (LLM) safety mechanisms and prevent its
Vulnerability / Attack Technique
Deliberately triggering LLM safety refusals to evade AI-assisted analysis
Technical Mechanism
Malware contains text that causes an analyst's LLM to refuse, so automated triage of the sample fails.
AI Security Category
LLM01:2025 Prompt Injection
Part of the Prompt Injection topic.
Relevant Frameworks
RealGround Analysis
Attackers are targeting defenders' AI tools. RealGround analysis: security teams using LLMs for triage need fallbacks when the model refuses or is manipulated.
Recommended Controls
- Treat LLM refusals during malware triage as a signal, not a dead end
- Keep non-LLM analysis paths for suspicious samples
Related RealGround Service
AI Red Teaming · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/09/russia-aligned-uac-0099-plants-nuclear.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-17.