Sandworm wiped a Ukrainian grain firm after UAC-0099 access
Original title: Russian hackers teamed up to wipe data at Ukrainian grain firm
ESET says a July 2025 phishing foothold led to a September wipe, using a new backdoor that talked over Yggdrasil.
ESET says the Russia-aligned group UAC-0099 and Sandworm jointly hit an unnamed Ukrainian grain logistics company. Phishing in July 2025 installed the MatchWok backdoor, followed by the previously unseen MythicRatatoskr tool for remote commands, file theft and screenshots. Researchers believe access was then handed to Sandworm, linked to Russia's GRU, which wiped data in September. Malware hid its traffic on the decentralized Yggdrasil network.
Unconfirmed: The UAC-0099-to-Sandworm handoff is ESET's assessment, and which group ran MythicRatatoskr is unresolved.
- The intrusion began with a phishing email that carried a malicious attachment.
- MythicRatatoskr has not been seen elsewhere, and a Linux variant may exist.
- ESET could not tell which group mainly operated the new backdoor.
- Yggdrasil carried encrypted traffic without a conventional central server.
- UAC-0099 has targeted Ukrainian government, finance, media and industry since at least 2022.
Impact: Network access, stolen files, screenshots and wiped company data
- Malware
- MatchWokMythicRatatoskr
- Organizations
- ESET
From the original article
2 min read at therecord.mediaThe Russian state-linked hacking group Sandworm collaborated with another threat actor to carry out a destructive cyberattack against a Ukrainian grain logistics company last year, researchers said Thursday.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.