A Ukrainian logistics company suffered a destructive data-wiping attack on September 17, 2025, after the threat group UAC-0099 gained access and subsequently handed it to Sandworm, according to ESET findings reported by The Hacker News on October 23, 2026.
The intrusion involved a previously undocumented backdoor, MythicRatatoskr, whose command-and-control server operated inside the Yggdrasil mesh network. ESET described the activity as the first documented use of Yggdrasil in this way by a state-aligned threat actor.
From phishing to a destructive attack
ESET traced initial access to July 16, 2025, when UAC-0099, also known as Earth Sirrush, sent a spear-phishing email containing a malicious attachment. The attachment led to a downloader called MATCHBOIL deploying the MATCHWOK backdoor.
MythicRatatoskr was deployed one day after MATCHWOK executed. More than two months after UAC-0099 established its foothold, Sandworm carried out the wiping operation by deploying the SDelete utility through Active Directory Group Policy, according to the researchers.
The account describes a handoff between the two groups: UAC-0099 secured access, while Sandworm conducted the destructive stage. ESET had previously reported a similar pattern in its APT Activity Report Q2 2025–Q3 2025, describing UAC-0099 transferring “validated targets” to Sandworm for further post-exploitation. Those operations targeted Ukraine’s government, energy, logistics and grain sectors.
A backdoor using Yggdrasil for command and control
ESET found indications that development of MythicRatatoskr began sometime between December 2024 and February 2025. The backdoor sends victim metadata to its command-and-control server, polls for instructions and returns command output. It can also take screenshots and upload or download files.
Other functions include changing the current working directory, listing directory contents, updating the command-and-control server URL, executing shell commands through cmd.exe and spawning a reverse SOCKS5 proxy. In the investigated intrusion, the malware was reportedly used to deploy a SOCKS5 server to route connections through the compromised network.
Some artifacts included a 10-minute startup delay. The researchers assessed that this likely helped the malware avoid connecting immediately to Yggdrasil and evade detection; the source does not establish that the delay successfully concealed it.
ESET researchers Anton Cherepanov and Peter Strýček said the use of Yggdrasil could signal broader adoption of experimental peer-to-peer networks by adversaries seeking more resilient and less visible infrastructure. That remains an assessment, rather than evidence of a wider trend.
The investigated compromise affected a Windows system. References to crond in MythicRatatoskr’s source code suggested to ESET that a Linux equivalent might also exist, but the reported findings did not confirm such a version.
