Sandworm wiped a Ukrainian logistics firm after UAC-0099 access
Original title: Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
ESET says MythicRatatoskr used a Yggdrasil mesh C2, and Sandworm wiped systems with SDelete on September 17, 2025.
According to ESET, UAC-0099 gained access to a Ukrainian logistics company on July 16, 2025, through a spear-phishing attachment that led to the MATCHBOIL downloader and MATCHWOK backdoor. A day later it deployed the previously undocumented MythicRatatoskr backdoor, which talks to a command-and-control server on the Yggdrasil mesh network. Access was handed to Sandworm, which wiped data on September 17, 2025, by dropping SDelete through Active Directory Group Policy. ESET says this is the first documented state-aligned abuse of Yggdrasil it knows of.
Unconfirmed: Collaboration with Sandworm is ESET’s assessment, and a Linux MythicRatatoskr variant is only inferred from source references.
- MythicRatatoskr can screenshot, transfer files, run cmd.exe, and open a reverse SOCKS5 proxy.
- Some samples delay startup by 10 minutes before connecting to Yggdrasil.
- Source references to crond suggest a possible Linux build, which ESET has not confirmed.
- ESET previously described UAC-0099 passing validated Ukrainian targets to Sandworm.
- The investigated host was Windows; NikoWiper is also derived from SDelete.
Impact: Espionage access followed by destructive data wiping
- ATT&CK
- T1566.001 Spearphishing AttachmentT1485 Data DestructionT1484.001 Group Policy ModificationT1113 Screen CaptureT1059.003 Windows Command Shell
- Organizations
- ESET
From the original article
2 min read at thehackernews.com
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.