UAC-0099 hands access to Sandworm: MythicRatatoskr backdoor on Yggdrasil mesh precedes wiper attack on Ukrainian grain logistics firm
ESET documents an intrusion at a Ukrainian grain logistics company in which UAC-0099 gained initial access on July 16th, 2025 via a spearphishing email with a malicious attachment, then handed access off to Sandworm. Sandworm carried out a data-wiping attack on September 17th, 2025. A day after initial access, the attackers deployed Mythi…