/
← Voltar ao feed
high logistics agriculture transportation

UAC-0099 hands access to Sandworm: MythicRatatoskr backdoor on Yggdrasil mesh precedes wiper attack on Ukrainian grain logistics firm

1 fonte(s) · 1 atualização(ões) · publicado 22/10/2026 05:45 · coletado há 18 horas

ESET documents an intrusion at a Ukrainian grain logistics company in which UAC-0099 gained initial access on July 16th, 2025 via a spearphishing email with a malicious attachment, then handed access off to Sandworm. Sandworm carried out a data-wiping attack on September 17th, 2025. A day after initial access, the attackers deployed MythicRatatoskr, a previously undocumented Go backdoor whose C&C server is hosted inside the Yggdrasil mesh network. ESET attributes the initial stage to UAC-0099 and the wiping to Sandworm, both with high confidence. It could not determine which group operated MythicRatatoskr. ESET believes this is the first documented abuse of Yggdrasil by a state-aligned actor.

Detalhes técnicos

  • Initial access: spearphishing led to a scheduled task pdfopentask running a PowerShell payload from %temp%\temporarydoc.txt. This deployed the MATCHBOIL downloader, which fetched the MATCHWOK backdoor (C&C uztickets[.]com, download from egyptanimals[.]com/animals/photoalbum). MATCHWOK persists via the UpdateMonitor Run key.
  • MythicRatatoskr: delivered the next day at 09:28 and later spread to other machines via an OpenSSH SFTP server. It runs as a Windows service (ieupdate, also updater.exe and WindowsDefenderSvc.exe). Development appears to date from December 2024 to February 2025.
  • Yggdrasil use: the malware is built on yggstack (userspace, no tunnel interface). It picks 3 random peers from an embedded base64 list of 32 public peers and generates a new Ed25519 key, and so a new IPv6 address, on each run. It talks to the C&C over HTTPS/443 using JSON POSTs with the message types checkin, tasking, result and getfile. Some samples have a 10-minute startup delay.
  • Capabilities: command execution, file system navigation, upload/download, screenshots, and a reverse SOCKS5 proxy (based on revsocks). The configuration is AES-256-CFB encrypted with a hardcoded key and stored at paths such as C:\Windows\Temp\.updatecache. The .crond path with forward slashes and the /tmp/.test_config string suggest a Linux variant may exist.
  • SOCKS5 server: a Go tool named bindProxy (go-socks5) listening on 127.0.0.1:33690, probably deployed via MythicRatatoskr. The filename krbtman.exe is used for both tools.
  • C&C: IPv6 201:b479:2771:8df4:b5eb:d007:63b0:2838, port 443 (proxy on 8080), with regularly rotated TLS certificates. ESET mapped it near the root of the Yggdrasil spanning tree.
  • Destruction: Sandworm deployed SDelete through Active Directory Group Policy, consistent with its known TTPs.
  • Context: ESET notes similar Russia-aligned collaborations, such as Gamaredon and Turla, and Gamaredon and InvisiMole.

Remediação

  • Block the public Yggdrasil peer addresses embedded in the malware, which ESET calls a viable mitigation, and monitor for Yggdrasil traffic (200::/7 IPv6 range).
  • Hunt for the listed host artifacts: service ieupdate, .updatecache and .crond config files, and the UpdateMonitor Run key.
  • Monitor for GPO-based deployment of SDelete and for unexpected SFTP lateral movement.
  • Harden email filtering against malicious attachments.

Linha do tempo

  1. welivesecurity.com ↗ · pub. 22/10/2026 05:45 · coletado 23/10 05:00 primeiro registro

    UAC-0099 hands access to Sandworm: MythicRatatoskr backdoor on Yggdrasil mesh precedes wiper attack on Ukrainian grain logistics firm

    ler a análise desta fonte

    ESET documents an intrusion at a Ukrainian grain logistics company in which UAC-0099 gained initial access on July 16th, 2025 via a spearphishing email with a malicious attachment, then handed access off to Sandworm. Sandworm carried out a data-wiping attack on September 17th, 2025. A day after initial access, the attackers deployed MythicRatatoskr, a previously undocumented Go backdoor whose C&C server is hosted inside the Yggdrasil mesh network. ESET attributes the initial stage to UAC-0099 and the wiping to Sandworm, both with high confidence. It could not determine which group operated MythicRatatoskr. ESET believes this is the first documented abuse of Yggdrasil by a state-aligned actor.

    Technical Details

    • Initial access: spearphishing led to a scheduled task pdfopentask running a PowerShell payload from %temp%\temporarydoc.txt. This deployed the MATCHBOIL downloader, which fetched the MATCHWOK backdoor (C&C uztickets[.]com, download from egyptanimals[.]com/animals/photoalbum). MATCHWOK persists via the UpdateMonitor Run key.
    • MythicRatatoskr: delivered the next day at 09:28 and later spread to other machines via an OpenSSH SFTP server. It runs as a Windows service (ieupdate, also updater.exe and WindowsDefenderSvc.exe). Development appears to date from December 2024 to February 2025.
    • Yggdrasil use: the malware is built on yggstack (userspace, no tunnel interface). It picks 3 random peers from an embedded base64 list of 32 public peers and generates a new Ed25519 key, and so a new IPv6 address, on each run. It talks to the C&C over HTTPS/443 using JSON POSTs with the message types checkin, tasking, result and getfile. Some samples have a 10-minute startup delay.
    • Capabilities: command execution, file system navigation, upload/download, screenshots, and a reverse SOCKS5 proxy (based on revsocks). The configuration is AES-256-CFB encrypted with a hardcoded key and stored at paths such as C:\Windows\Temp\.updatecache. The .crond path with forward slashes and the /tmp/.test_config string suggest a Linux variant may exist.
    • SOCKS5 server: a Go tool named bindProxy (go-socks5) listening on 127.0.0.1:33690, probably deployed via MythicRatatoskr. The filename krbtman.exe is used for both tools.
    • C&C: IPv6 201:b479:2771:8df4:b5eb:d007:63b0:2838, port 443 (proxy on 8080), with regularly rotated TLS certificates. ESET mapped it near the root of the Yggdrasil spanning tree.
    • Destruction: Sandworm deployed SDelete through Active Directory Group Policy, consistent with its known TTPs.
    • Context: ESET notes similar Russia-aligned collaborations, such as Gamaredon and Turla, and Gamaredon and InvisiMole.

    Remediation

    • Block the public Yggdrasil peer addresses embedded in the malware, which ESET calls a viable mitigation, and monitor for Yggdrasil traffic (200::/7 IPv6 range).
    • Hunt for the listed host artifacts: service ieupdate, .updatecache and .crond config files, and the UpdateMonitor Run key.
    • Monitor for GPO-based deployment of SDelete and for unexpected SFTP lateral movement.
    • Harden email filtering against malicious attachments.