Executive summary
This report delves into the activity surrounding the initial access gained by UAC‑0099 on July 16th, 2025, which was later handed off to Sandworm leading to a data-wiping attack on September 17th, 2025. The focus is on the unique MythicRatatoskr backdoor, which utilizes the Yggdrasil mesh network to communicate with a C&C server hosted within it.
Findings regarding MythicRatatoskr were presented at LABScon on September 18th, 2026, and at the Virus Bulletin conference on October 16th, 2026.
Key points of this blogpost:
- On July 16th, 2025, UAC-0099 gained initial access to a grain logistics company in Ukraine via a spearphishing email with a malicious attachment, leading to the execution chain of the MATCHWOK backdoor.
- MythicRatatoskr, a previously undocumented backdoor, was deployed by the attackers the following day, communicating with a C&C server hosted inside the Yggdrasil mesh network. This backdoor is unique and has indications of a potential Linux variant.
- Yggdrasil is a decentralized mesh network that ensures end-to-end protected IPv6 communication between nodes.
- Access was eventually handed off from UAC-0099 to Sandworm, culminating in a data-wiping attack.
Cooperation among Russia-aligned actors
The documented handover in this report is not an isolated incident. Sandworm is associated with GRU Unit 74455, and UAC-0099’s targeting suggests alignment with Russian interests.
Prior in 2025, collaboration between Russia-aligned Gamaredon and Turla was uncovered, both linked to the Federal Security Service of the Russian Federation (FSB). This collaboration highlights the potential for coordinated cyberespionage campaigns among Russia-aligned groups to enhance operational impact.
Overview of the intrusion
Based on ESET telemetry, the sequence of events involved a scheduled task triggering the execution of a PowerShell payload, leading to the deployment of MATCHBOIL and subsequently the MythicRatatoskr backdoor. Further telemetry indicated the deployment of additional MythicRatatoskr samples via an OpenSSH SFTP server.
Subsequent detection of a SOCKS5 server on certain machines, likely deployed using MythicRatatoskr, preceded the data-wiping attack executed by Sandworm using the SDelete utility via Active Directory Group Policy.
Therefore, UAC‑0099 is believed to have facilitated initial access for Sandworm.
This blogpost primarily analyzes the MythicRatatoskr backdoor, the Yggdrasil network hosting its C&C server, and the accompanying SOCKS5 server, omitting the previously analyzed MATCHBOIL and MATCHWOK tools.
A squirrel in the world tree
Named after the Norse mythology squirrel Ratatoskr that traverses the sacred tree Yggdrasil carrying messages, the MythicRatatoskr backdoor operates as a messenger within the Yggdrasil network.
Yggdrasil, a decentralized mesh network, establishes encrypted connectivity between devices without a central hub, providing robust and secure communication. While not designed for anonymity, it offers resilient connectivity for legitimate users.
Attribution
Based on the malware attributed to UAC‑0099 and Sandworm, the report attributes the attack stages to these groups with high confidence. The handoff of access from UAC‑0099 to Sandworm is assessed with high confidence, though the specific operation of the MythicRatatoskr backdoor remains unclear.
UAC‑0099 profile
UAC‑0099, a cyberespionage group targeting entities in Ukraine, is believed to align with Russian interests. Known for deploying MATCHBOIL and LONEPAGE, the group has been active since at least 2022.
Sandworm profile
Sandworm, a Russia-aligned threat group notorious for destructive attacks, gained notoriety for its operations against Ukrainian energy companies and the 2017 NotPetya data-wiping attack.
In February 2018, Sandworm initiated a data-wiping attack known as the Olympic Destroyer against the organizers of the 2018 Winter Olympics in Pyeongchang. The group, known for its use of advanced malware like Industroyer, attempted to deploy a new variant of this malware, Industroyer2, in April 2022 during an attack on an energy company in Ukraine that was thwarted by CERT‑UA. Since February 2022, Sandworm has been actively deploying data wipers against strategic organizations in Ukraine. The group has been attributed to GRU’s Unit 74455, as detailed in the US Department of Justice’s indictment against six Russian hackers in October 2020.
The compromise chain involved initial access through a spearphishing email with a malicious attachment, leading to the execution of the MATCHWOK backdoor, which then executed MythicRatatoskr. Persistence was achieved by MATCHBOIL adding a registry value for MATCHWOK and starting MythicRatatoskr as a Windows service named ieupdate. The attackers used MythicRatatoskr for collection and exfiltration of data to the C&C server via the Yggdrasil network.
MythicRatatoskr, a backdoor written in Go, utilizes the Yggdrasil network for communication with its C&C server. The network protocol of Yggdrasil allows for protected end-to-end IPv6 communication between peers. The malware also contains host-based artifacts for persistence and configuration paths. The backdoor’s code is based on yggstack, making it portable and enabling communication via a network stack in the user space. The MythicRatatoskr malware randomly selects three peers from a hardcoded list and connects to them to join the public Yggdrasil network. Once connected, it communicates with its C&C server, which is also part of the network, via HTTPS on port 443.
Communication with the C&C server involves JSON-encoded HTTP POST requests containing a UUID, message type, and optional data. The four message types are ‘checkin’, ‘tasking’, ‘result’, and ‘getfile’.
Blocking the public peer addresses is a potential mitigation strategy, despite the C&C server being hosted within the Yggdrasil network.
There are two types of configurations for MythicRatatoskr: a backdoor-specific configuration and a Yggdrasil configuration for joining the mesh network.
The main MythicRatatoskr configuration is stored in a file at a hardcoded path, with different paths identified in various samples. The backdoor-specific configuration is encrypted using AES-256-CFB with a hardcoded key embedded in the binary.
The Yggdrasil configuration involves generating a new configuration with a new Ed25519 private key each time the malware runs. The backdoor connects to publicly available Yggdrasil peers to reach the C&C server.
MythicRatatoskr supports various backdoor functionalities such as command execution, file system navigation, file transfer, screenshot capture, and proxying. Table 3 enumerates all of the backdoor commands in MythicRatatoskr, each identified by a hardcoded command ID string in the code.
Table 3. MythicRatatoskr commands
| Command | Description |
|———-|————-|
| chtime | Change the sleep configuration value (refer to Table 2) |
| expose | Expose a local TCP port to forward TCP connections from the Yggdrasil network |
| upload | Request a file from the C&C server and save it to disk via an HTTP POST request |
| download | Send a local file to the C&C server |
| nodeinfo | Retrieve information about the current Yggdrasil node, including its IPv6 address, subnet, and public key |
| screenshot | Capture screenshots of active displays, not saved to disk but included in the command result |
| cd | Change the current working directory |
| ls | List the contents of the current working directory |
| pwd | Get the current working directory |
| churl | Modify the C&C server URL in the configuration |
| proxy | Manage a reverse SOCKS5 proxy connection over the Yggdrasil network |
The “proxy” command within MythicRatatoskr creates a reverse SOCKS5 proxy connection, distinct from the standalone SOCKS5 server detailed below, which establishes a local SOCKS5 server. UAC-0099 seems to have successfully infiltrated a Ukrainian logistics company using their established tools. This access was later utilized in operations by Sandworm, resulting in extensive destruction.
Moreover, we have detected a new backdoor named MythicRatatoskr, which is linked to either UAC-0099 or Sandworm. The Command and Control server for this backdoor is situated within the Yggdrasil mesh network, making it challenging to pinpoint its physical location. This backdoor was likely used to deploy a SOCKS5 server to reroute connections through the compromised network.
This incident marks the first known case of Yggdrasil being manipulated in this manner by a state-sponsored threat actor. It could indicate a growing trend of adversaries leveraging experimental peer-to-peer networks to enhance the resilience and stealth of their infrastructure.
Ultimately, Sandworm executed a data-wiping attack by deploying the SDelete utility through Active Directory Group Policy, a tactic consistent with previous destructive operations by Sandworm.
If you have any questions regarding our research published on WeLiveSecurity, feel free to reach out to us at threatintel@eset.com.
For more information on our private APT intelligence reports and data feeds, visit the ESET Threat Intelligence page. To seamlessly integrate the original HTML content into a WordPress platform, you can follow these steps:
1. Copy the original HTML content from your source.
2. Create a new WordPress post or page where you want to add the content.
3. Switch to the Text editor in WordPress (instead of the Visual editor) to preserve the original HTML tags.
4. Paste the copied HTML content into the Text editor in WordPress.
5. Review the content to ensure all the headers, key points, and formatting have been preserved.
6. Click on the Preview button to see how the content will look on your WordPress site.
7. Make any necessary adjustments to the formatting or layout to better fit the WordPress theme.
8. Once you are satisfied with the appearance, click on the Publish button to make the content live on your WordPress site.
By following these steps, you can seamlessly integrate the original HTML content into your WordPress platform while preserving the original tags, headers, and key points. Can you please rewrite the sentence for me? sentence: “I am going to the store to buy some groceries.”
Revised sentence: “I will be heading to the store to purchase groceries.”
