Sandworm wiped a Ukrainian logistics firm after UAC-0099 access
ESET says MythicRatatoskr used a Yggdrasil mesh C2, and Sandworm wiped systems with SDelete on September 17, 2025.
73
Malware
MythicRatatoskr
- Mentions · 7d3
- Mentions · 30d3
- All mentions3
- First seenOct 21, 2026
- Last mentioned2d ago
Timeline
3 articles · newest firstUAC-0099 handed Ukraine grain firm access to Sandworm
MythicRatatoskr used Yggdrasil for C2; Sandworm later wiped data with SDelete via Group Policy.
76
Sandworm wiped a Ukrainian grain firm after UAC-0099 access
ESET says a July 2025 phishing foothold led to a September wipe, using a new backdoor that talked over Yggdrasil.
68
Appears with
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.