UAC-0099 hands access to Sandworm: MythicRatatoskr backdoor on Yggdrasil precedes SDelete wiper attack on Ukrainian grain logistics firm

Linha do tempo

1. thehackernews.com ↗ · pub. 23/10/2026 08:11 · coletado 23/10 10:00

   UAC-0099 hands off access to Sandworm for wiper attack on Ukrainian logistics firm using MythicRatatoskr backdoor over Yggdrasil

   ler a análise desta fonte ocultar

   ESET reports that UAC-0099 (aka Earth Sirrush) gained initial access to a Ukrainian logistics company on July 16, 2025, through a spear-phishing email with a malicious attachment. The group then handed access to Sandworm, which carried out a data-wiping attack on September 17, 2025, more than two months after the initial foothold. UAC-0099 used a previously undocumented backdoor, MythicRatatoskr, whose C2 server is hosted inside the Yggdrasil mesh network. ESET says this is the first documented abuse of Yggdrasil by a state-aligned actor and may signal a broader adoption of experimental peer-to-peer networks for resilient, stealthy infrastructure. ESET had already assessed that UAC-0099 passes "validated targets" to Sandworm for post-exploitation.

   Technical Details

   • Initial access: spear-phishing attachment that led to the MATCHBOIL downloader and the MATCHWOK backdoor. MythicRatatoskr was deployed a day after MATCHWOK was executed.
   • MythicRatatoskr development appears to have started between December 2024 and February 2025.
   • Capabilities: send victim metadata to the C2, poll for commands, return command output, take screenshots, upload and download files, change the working directory, enumerate directories, change the C2 URL, run shell commands via cmd.exe, and spawn a reverse SOCKS5 proxy.
   • Some artifacts include a 10-minute startup delay, likely to avoid immediately connecting to Yggdrasil and to evade detection.
   • Source code references to "crond" suggest a possible Linux version.
   • The backdoor was used to deploy a SOCKS5 server that routed connections through the compromised network.
   • Sandworm wiped data by dropping the SDelete utility via Active Directory Group Policy. The Sandworm-linked NikoWiper is also derived from SDelete.
   • ESET's earlier APT Activity Report (Q2–Q3 2025) said these operations targeted the government, energy, logistics and grain sectors in Ukraine.
   • Similar Russia-aligned cooperation was previously observed: Gamaredon's PteroGraphin was used to deploy Turla's Kazuar, and Gamaredon's Pterodo was used to retrieve InvisiMole.

   Remediation

   The article gives no explicit remediation guidance.

2. welivesecurity.com ↗ · pub. 22/10/2026 05:45 · coletado 23/10 05:00

   UAC-0099 hands access to Sandworm: MythicRatatoskr backdoor on Yggdrasil mesh precedes wiper attack on Ukrainian grain logistics firm

   ler a análise desta fonte ocultar

   ESET documents an intrusion at a Ukrainian grain logistics company in which UAC-0099 gained initial access on July 16th, 2025 via a spearphishing email with a malicious attachment, then handed access off to Sandworm. Sandworm carried out a data-wiping attack on September 17th, 2025. A day after initial access, the attackers deployed MythicRatatoskr, a previously undocumented Go backdoor whose C&C server is hosted inside the Yggdrasil mesh network. ESET attributes the initial stage to UAC-0099 and the wiping to Sandworm, both with high confidence. It could not determine which group operated MythicRatatoskr. ESET believes this is the first documented abuse of Yggdrasil by a state-aligned actor.

   Technical Details

   • Initial access: spearphishing led to a scheduled task pdfopentask running a PowerShell payload from %temp%\temporarydoc.txt. This deployed the MATCHBOIL downloader, which fetched the MATCHWOK backdoor (C&C uztickets[.]com, download from egyptanimals[.]com/animals/photoalbum). MATCHWOK persists via the UpdateMonitor Run key.
   • MythicRatatoskr: delivered the next day at 09:28 and later spread to other machines via an OpenSSH SFTP server. It runs as a Windows service (ieupdate, also updater.exe and WindowsDefenderSvc.exe). Development appears to date from December 2024 to February 2025.
   • Yggdrasil use: the malware is built on yggstack (userspace, no tunnel interface). It picks 3 random peers from an embedded base64 list of 32 public peers and generates a new Ed25519 key, and so a new IPv6 address, on each run. It talks to the C&C over HTTPS/443 using JSON POSTs with the message types checkin, tasking, result and getfile. Some samples have a 10-minute startup delay.
   • Capabilities: command execution, file system navigation, upload/download, screenshots, and a reverse SOCKS5 proxy (based on revsocks). The configuration is AES-256-CFB encrypted with a hardcoded key and stored at paths such as C:\Windows\Temp\.updatecache. The .crond path with forward slashes and the /tmp/.test_config string suggest a Linux variant may exist.
   • SOCKS5 server: a Go tool named bindProxy (go-socks5) listening on 127.0.0.1:33690, probably deployed via MythicRatatoskr. The filename krbtman.exe is used for both tools.
   • C&C: IPv6 201:b479:2771:8df4:b5eb:d007:63b0:2838, port 443 (proxy on 8080), with regularly rotated TLS certificates. ESET mapped it near the root of the Yggdrasil spanning tree.
   • Destruction: Sandworm deployed SDelete through Active Directory Group Policy, consistent with its known TTPs.
   • Context: ESET notes similar Russia-aligned collaborations, such as Gamaredon and Turla, and Gamaredon and InvisiMole.

   Remediation

   • Block the public Yggdrasil peer addresses embedded in the malware, which ESET calls a viable mitigation, and monitor for Yggdrasil traffic (200::/7 IPv6 range).
   • Hunt for the listed host artifacts: service ieupdate, .updatecache and .crond config files, and the UpdateMonitor Run key.
   • Monitor for GPO-based deployment of SDelete and for unexpected SFTP lateral movement.
   • Harden email filtering against malicious attachments.
3. olhardigital.com.br ↗ · pub. 22/10/2026 10:01 · coletado 22/10 11:02 primeiro registro

   Russia-linked UAC-0099 and Sandworm use Yggdrasil network and SDelete in destructive attack on Ukrainian grain logistics firm

   ler a análise desta fonte ocultar

   ESET reports that Russia-linked actors used the decentralized Yggdrasil mesh network to hide command-and-control traffic during an attack on a Ukrainian grain logistics company in July 2025. ESET says this is the first documented use of the technology by a state-linked group. The intrusion began with a phishing email sent in a campaign against logistics firms, grain companies and port terminals in Ukraine, and ended with data destruction on the affected computers. ESET attributes the initial access to UAC-0099 and assesses that access was handed to Sandworm, which showed characteristics tied to the wiping stage. ESET could not determine which group operated the backdoor between the intrusion and the destruction. The victim was not named, and it is not confirmed whether operations were disrupted.

   Technical Details

   • Initial access: phishing email in a campaign targeting Ukrainian logistics, grain and port terminal organizations.
   • After gaining access, the attackers installed a remote-control program that could browse files, take screenshots and steal documents.
   • The program communicated through a server hidden on Yggdrasil, an experimental volunteer-run mesh network with no central owner. According to ESET researcher Anton Cherepanov, its mesh structure makes the traffic harder to detect.
   • With administrator privileges, the attackers ran SDelete, a legitimate Microsoft utility for permanently deleting files, to destroy data.
   • Attribution: UAC-0099 is blamed for the initial intrusion. The destructive stage showed traits associated with Sandworm, a group widely linked to Russian military intelligence and previously blamed for attacks on energy infrastructure in Ukraine and Poland.

   Remediation

   The article gives no specific remediation guidance.