Skip to content
NewA calmer, faster ZeroHour
StoryThreat actorhigh

UAC-0099 and Sandworm wiped a Ukrainian grain firm

3 sources · 3 articlesFirst reported Updated ()
What's new

October 23: The Hacker News added ESET’s claim of the first known state-aligned Yggdrasil abuse, plus MythicRatatoskr capabilities and an unconfirmed Linux build.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

ESET says a 2025 UAC-0099 intrusion and Yggdrasil backdoor preceded a Sandworm wipe at a Ukrainian grain firm.

ESET says Russia-aligned UAC-0099 and Sandworm jointly compromised an unnamed Ukrainian grain logistics company. Spearphishing on July 16, 2025 led to the MATCHBOIL downloader and MATCHWOK backdoor; the previously unseen MythicRatatoskr backdoor was deployed the next day and used the Yggdrasil mesh for command and control. ESET attributes the stages with high confidence but has not determined which group mainly operated MythicRatatoskr, and notes a possible unconfirmed Linux variant. On September 17, 2025, Sandworm, linked by ESET to GRU Unit 74455, wiped data with Microsoft’s SDelete delivered through Active Directory Group Policy. The Hacker News reports ESET called this the first documented state-aligned abuse of Yggdrasil it knows of.

Key facts
  • Victim was an unnamed Ukrainian grain logistics company.
  • July 16, 2025 spearphishing led to MATCHBOIL and MATCHWOK.
  • MythicRatatoskr used Yggdrasil and has not been seen elsewhere.
  • Sandworm wiped data with SDelete via Group Policy on September 17, 2025.
  • ESET links Sandworm to GRU Unit 74455.
  • UAC-0099 has targeted Ukrainian sectors since at least 2022.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Jul 16, 2025Spearphishing gave UAC-0099 access to the firm. · ESET WeLiveSecurity
  2. Jul 17, 2025MythicRatatoskr was deployed for Yggdrasil command and control. · ESET WeLiveSecurity
  3. Sep 17, 2025Sandworm wiped data with SDelete via Group Policy. · ESET WeLiveSecurity
  4. Sep 18, 2026ESET presented the findings at LABScon. · ESET WeLiveSecurity
  5. Oct 16, 2026ESET presented the findings at Virus Bulletin. · ESET WeLiveSecurity

What each outlet adds

beyond the shared facts
  • The RecordNames the grain victim and UAC-0099’s targeting since 2022.
  • ESET WeLiveSecurityExact intrusion dates, SDelete method, and GRU Unit 74455 link.
  • The Hacker NewsFirst known state-aligned Yggdrasil abuse and backdoor capabilities.
Products
YggdrasilSDelete
Threat actors
UAC-0099Sandworm
Malware
MythicRatatoskrMATCHBOILMATCHWOKSDeleteMatchWok
Organizations
CERT-UAGRUESET
Countries
UkraineRussia

Coverage

oldest first · one row per article · UTC
  1. · 4d ago The RecordFirst report

    Sandworm wiped a Ukrainian grain firm after UAC-0099 access

    ESET says a July 2025 phishing foothold led to a September wipe, using a new backdoor that talked over Yggdrasil.

  2. · 3d ago ESET WeLiveSecurity

    UAC-0099 handed Ukraine grain firm access to Sandworm

    MythicRatatoskr used Yggdrasil for C2; Sandworm later wiped data with SDelete via Group Policy.

  3. · 2d ago The Hacker News

    Sandworm wiped a Ukrainian logistics firm after UAC-0099 access

    ESET says MythicRatatoskr used a Yggdrasil mesh C2, and Sandworm wiped systems with SDelete on September 17, 2025.