UAC-0099 handed Ukraine grain firm access to Sandworm
Original title: MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
MythicRatatoskr used Yggdrasil for C2; Sandworm later wiped data with SDelete via Group Policy.
ESET says UAC-0099 gained access to a Ukrainian grain logistics company on July 16, 2025, through a spearphishing attachment that led to MATCHBOIL and the MATCHWOK backdoor, then deployed the previously undocumented MythicRatatoskr backdoor the next day. The backdoor talks to a C&C inside the Yggdrasil mesh, and ESET has not seen it elsewhere. About two months later, on September 17, 2025, Sandworm wiped data using SDelete delivered by Active Directory Group Policy. ESET attributes the stages with high confidence but has not determined which group mainly operated MythicRatatoskr.
Unconfirmed: ESET has not determined whether UAC-0099 or Sandworm primarily operated MythicRatatoskr.
- A scheduled task named pdfopentask ran PowerShell from %temp%\temporarydoc.txt.
- MATCHWOK’s C&C was https://uztickets[.]com; the downloader used egyptanimals[.]com.
- Further samples were copied with an OpenSSH SFTP server; a SOCKS5 server followed.
- ESET links Sandworm to GRU Unit 74455 and notes a possible Linux variant.
- Findings were presented at LABScon on September 18, 2026, and Virus Bulletin on October 16, 2026.
Impact: Initial access, then data wiped at a Ukrainian grain firm
- ATT&CK
- T1566.001 Spearphishing AttachmentT1053.005 Scheduled TaskT1059.001 PowerShellT1484.001 Group Policy ModificationT1485 Data Destruction
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | egyptanimals.com | CHWOK backdoor (C&C: https://uztickets[.]com ) from https://egyptanimals[.]com/animals/photoalbum . The following day, at 09:28, a new b |
| domain | uztickets.com | deployed, in this case, the MATCHWOK backdoor (C&C: https://uztickets[.]com ) from https://egyptanimals[.]com/animals/photoalbum . Th |
From the original article
13 min read at welivesecurity.com
ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm
welivesecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.