Sandworm wiped a Ukrainian logistics firm after UAC-0099 access
ESET says MythicRatatoskr used a Yggdrasil mesh C2, and Sandworm wiped systems with SDelete on September 17, 2025.
73
Malware
MATCHWOK
- Mentions · 7d0
- Mentions · 30d9
- All mentions10
- First seenSep 11, 2026
- Last mentioned7d ago
Timeline
10 articles · newest firstUAC-0099 handed Ukraine grain firm access to Sandworm
MythicRatatoskr used Yggdrasil for C2; Sandworm later wiped data with SDelete via Group Policy.
76
Sandworm wiped a Ukrainian grain firm after UAC-0099 access
ESET says a July 2025 phishing foothold led to a September wipe, using a new backdoor that talked over Yggdrasil.
68
12th October – Threat Intelligence Report
Check Point's weekly report covers a Denmark registry breach of 8.8 million people, ransomware, and exploited enterprise flaws.
82
MATCHBOIL Malware Uses Cloudflare-Hidden C2 Servers to Deliver Backdoor Payloads
UAC-0099's MATCHBOIL downloader hides C2 behind Cloudflare and delivers MATCHWOK to Ukrainian firms.
66
Russian-aligned spies upgrade malware used in attacks on Ukrainian transport, energy firms
UAC-0099 upgraded MatchBoil malware in espionage attacks on Ukrainian transport and energy firms.
74
What is MATCHBOIL? The Russia-aligned malware that installs a spying backdoor
Russia-aligned UAC-0099 uses MATCHBOIL to install the MATCHWOK spy backdoor on Ukrainian transport, manufacturing, and energy firms.
76
MATCHBOIL: New tricks, same old evil intentions
ESET details MATCHBOIL, a C# downloader UAC-0099 uses against Ukrainian transport, manufacturing, and energy firms.
67
Earth Sirrush Espionage Activity May Support Sandworm Operations Against Ukraine
Earth Sirrush has spear-phished Ukrainian government and logistics since 2022, possibly feeding Sandworm.
78
Hackers Weaponize AI Safety Guardrails to Hide Malware From LLM-Powered Security Scanners
ESET says Russia-aligned actor UAC-0099 hid guardrail-triggering comments in VBScript to derail LLM-based malware scanners in Ukraine.
58
Related CVEs
by mentions- CVE-2026-2158999%9.3Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
- CVE-2026-8877911%8.7Unauthenticated denial of service in NetScaler ADC and Gateway
- CVE-2023-38831100%7.8Code Execution in RARLAB WinRAR via Crafted ZIP File/Folder Name Confusion
- Critical improper access control in Cisco NX-OS
- SYSTEM code execution via Backup Viewer in Veeam Backup
Appears with
- UAC-0099threat actor · 10
- MatchBoilmalware · 9
- ESETorganization · 8
- CERT-UAorganization · 7
- Sandwormthreat actor · 6
- .NET Reactorproduct · 3
- MythicRatatoskrmalware · 3
- Ezirizvendor · 3
- Dragstaremalware · 3
- LONEPAGEmalware · 2
- Fortinetorganization · 2
- FortiGateproduct · 1
- ATBorganization · 1
- Veeam Backup & Replicationproduct · 1
- ASHVEINmalware · 1
- Bambooproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.