UAC-0099 hands off access to Sandworm for wiper attack on Ukrainian logistics firm using MythicRatatoskr backdoor over Yggdrasil
ESET reports that UAC-0099 (aka Earth Sirrush) gained initial access to a Ukrainian logistics company on July 16, 2025, through a spear-phishing email with a malicious attachment. The group then handed access to Sandworm, which carried out a data-wiping attack on September 17, 2025, more than two months after the initial foothold. UAC-0099 used a previously undocumented backdoor, MythicRatatoskr, whose C2 server is hosted inside the Yggdrasil mesh network. ESET says this is the first documented abuse of Yggdrasil by a state-aligned actor and may signal a broader adoption of experimental peer-to-peer networks for resilient, stealthy infrastructure. ESET had already assessed that UAC-0099 passes "validated targets" to Sandworm for post-exploitation.
Detalhes técnicos
- Initial access: spear-phishing attachment that led to the MATCHBOIL downloader and the MATCHWOK backdoor. MythicRatatoskr was deployed a day after MATCHWOK was executed.
- MythicRatatoskr development appears to have started between December 2024 and February 2025.
- Capabilities: send victim metadata to the C2, poll for commands, return command output, take screenshots, upload and download files, change the working directory, enumerate directories, change the C2 URL, run shell commands via
cmd.exe, and spawn a reverse SOCKS5 proxy. - Some artifacts include a 10-minute startup delay, likely to avoid immediately connecting to Yggdrasil and to evade detection.
- Source code references to "crond" suggest a possible Linux version.
- The backdoor was used to deploy a SOCKS5 server that routed connections through the compromised network.
- Sandworm wiped data by dropping the SDelete utility via Active Directory Group Policy. The Sandworm-linked NikoWiper is also derived from SDelete.
- ESET's earlier APT Activity Report (Q2–Q3 2025) said these operations targeted the government, energy, logistics and grain sectors in Ukraine.
- Similar Russia-aligned cooperation was previously observed: Gamaredon's PteroGraphin was used to deploy Turla's Kazuar, and Gamaredon's Pterodo was used to retrieve InvisiMole.
Remediação
The article gives no explicit remediation guidance.
Linha do tempo
-
UAC-0099 hands off access to Sandworm for wiper attack on Ukrainian logistics firm using MythicRatatoskr backdoor over Yggdrasil
ler a análise desta fonte ocultar
ESET reports that UAC-0099 (aka Earth Sirrush) gained initial access to a Ukrainian logistics company on July 16, 2025, through a spear-phishing email with a malicious attachment. The group then handed access to Sandworm, which carried out a data-wiping attack on September 17, 2025, more than two months after the initial foothold. UAC-0099 used a previously undocumented backdoor, MythicRatatoskr, whose C2 server is hosted inside the Yggdrasil mesh network. ESET says this is the first documented abuse of Yggdrasil by a state-aligned actor and may signal a broader adoption of experimental peer-to-peer networks for resilient, stealthy infrastructure. ESET had already assessed that UAC-0099 passes "validated targets" to Sandworm for post-exploitation.
Technical Details
- Initial access: spear-phishing attachment that led to the MATCHBOIL downloader and the MATCHWOK backdoor. MythicRatatoskr was deployed a day after MATCHWOK was executed.
- MythicRatatoskr development appears to have started between December 2024 and February 2025.
- Capabilities: send victim metadata to the C2, poll for commands, return command output, take screenshots, upload and download files, change the working directory, enumerate directories, change the C2 URL, run shell commands via
cmd.exe, and spawn a reverse SOCKS5 proxy. - Some artifacts include a 10-minute startup delay, likely to avoid immediately connecting to Yggdrasil and to evade detection.
- Source code references to "crond" suggest a possible Linux version.
- The backdoor was used to deploy a SOCKS5 server that routed connections through the compromised network.
- Sandworm wiped data by dropping the SDelete utility via Active Directory Group Policy. The Sandworm-linked NikoWiper is also derived from SDelete.
- ESET's earlier APT Activity Report (Q2–Q3 2025) said these operations targeted the government, energy, logistics and grain sectors in Ukraine.
- Similar Russia-aligned cooperation was previously observed: Gamaredon's PteroGraphin was used to deploy Turla's Kazuar, and Gamaredon's Pterodo was used to retrieve InvisiMole.
Remediation
The article gives no explicit remediation guidance.