Executive Summary

In a concerning development for global cybersecurity, a multi-stage intrusion has been uncovered involving a strategic handoff between two Russia-aligned threat actors: UAC-0099 and the notorious Sandworm group (linked to GRU Unit 74455). This report details an attack that began on July 16, 2025, against a Ukrainian grain logistics company, ultimately culminating in a destructive data-wiping operation on September 17, 2025.

Central to this campaign is the discovery of "MythicRatatoskr," a highly specialized backdoor written in the Go programming language. This malware represents a significant evolution in adversary tradecraft, as it utilizes the Yggdrasil decentralized mesh network to facilitate Command-and-Control (C&C) communications. By leveraging an encrypted IPv6 overlay, the attackers achieved a level of resilience and obfuscation that challenges traditional network perimeter defenses. This report explores the mechanics of this tool, the pattern of cooperation between threat groups, and the broader implications for critical infrastructure defense.

The Chronology of the Intrusion

The breach followed a precise, multi-phased timeline that suggests a highly coordinated effort between initial access brokers and destructive operators.

Phase 1: Initial Foothold (July 2025)

At 06:59 on July 16, 2025, the target organization’s security perimeter was breached via a spearphishing email containing a malicious attachment. ESET telemetry confirmed that a scheduled task, cleverly disguised as pdfopentask, was executed on a workstation. This task triggered a PowerShell payload hidden within %temp%temporarydoc.txt.

Within a minute, the attackers deployed "MATCHBOIL," a downloader designed to fetch subsequent payloads. This downloader retrieved the "MATCHWOK" backdoor from a compromised external site. By the following morning, July 17, at 09:28, a new, more sophisticated binary was delivered: the MythicRatatoskr backdoor. Given the timeline, analysts have high confidence that the MATCHWOK execution chain was the direct delivery mechanism for MythicRatatoskr.

Phase 2: Lateral Movement and Persistence (August 2025)

Over the following weeks, the attackers utilized MythicRatatoskr to move laterally. Additional samples were deployed to various machines across the organization’s network via an OpenSSH SFTP server. During this period, a SOCKS5 server—deployed to maintain a persistent proxy channel—was also identified. The presence of these tools suggests the actors were preparing the environment for a long-term presence or a final destructive act.

Phase 3: The Destructive Blow (September 2025)

After roughly two months of silent surveillance and internal reconnaissance, the operation shifted from espionage to sabotage. On September 17, 2025, the intruders initiated a data-wiping attack. This was achieved by deploying the SDelete utility via Active Directory Group Policy. This specific technique—the use of standard administrative tools to execute destructive payloads—is a hallmark of Sandworm’s well-documented Tactics, Techniques, and Procedures (TTPs).

Technical Analysis: The MythicRatatoskr Backdoor

Named after the mythological squirrel that traverses the Yggdrasil world tree, MythicRatatoskr serves as a sophisticated messenger within the Yggdrasil mesh network.

Architecture and Mesh Networking

Yggdrasil is an experimental, decentralized mesh network that creates an encrypted IPv6 overlay. Because it operates without a central hub, it is inherently robust and difficult for authorities to disrupt. MythicRatatoskr is built upon the yggstack library, allowing it to interface with this network without requiring administrative privileges to create tunnel interfaces.

When the backdoor executes, it generates a unique Ed25519 key pair, ensuring end-to-end encryption for its C&C traffic. It connects to the public Yggdrasil network by picking three random peers from a hardcoded list of 32 entries embedded in the binary. Once connected, it communicates via HTTPS over port 443, effectively hiding its traffic within the noise of the mesh network.

Configuration and Stealth

The backdoor employs a dual-configuration approach. It utilizes an embedded default configuration, but allows operators to push updates via C&C commands. The configuration is encrypted using AES-256-CFB with a hardcoded key. Notably, the malware exhibits "typos" in its configuration paths (e.g., %LocalAppData%/Temp/.crond using forward slashes), which strongly suggests that the developers primarily work in Unix-like environments and may be maintaining cross-platform variants of the malware.

Command Capabilities

MythicRatatoskr provides the operators with a comprehensive suite of tools for total control over the infected host:

• File Operations: upload, download, ls, cd, and pwd.
• Proxying: The proxy command facilitates a reverse SOCKS5 proxy connection, enabling the attackers to tunnel traffic through the compromised machine.
• Reconnaissance: The screenshot and nodeinfo commands allow operators to monitor user activity and confirm the host’s network status within the Yggdrasil overlay.
• Execution: A shell command allows for the execution of arbitrary commands via cmd.exe.

Attribution and Cooperation: UAC-0099 and Sandworm

This intrusion provides definitive evidence of cooperation between UAC-0099 and Sandworm. While UAC-0099—a group active since 2022 and primarily focused on espionage—acted as the initial access broker, the final destructive phase is attributed to Sandworm, a group infamous for its role in the 2015/2016 Ukrainian power grid attacks and the NotPetya wiper campaign.

This collaboration is not an isolated incident. ESET Research has previously documented cooperation between other Russia-aligned actors, such as Gamaredon and Turla. Such handoffs suggest a specialized division of labor within the Russian cyber-espionage ecosystem: UAC-0099 secures the foothold, conducts the reconnaissance, and prepares the environment, while Sandworm provides the "heavy lifting" for disruptive operations. This model allows the Kremlin to maintain a degree of operational compartmentalization while maximizing the impact of their cyber campaigns.

Implications for Global Cybersecurity

The abuse of the Yggdrasil network is a watershed moment for threat intelligence. It signals that adversaries are moving beyond standard C&C infrastructure—which is often easily blocked by domain and IP reputation filters—toward decentralized, resilient peer-to-peer networks.

Strategic Resilience

The use of Yggdrasil presents a significant challenge to defensive operations. Traditional perimeter defenses, such as firewalls and Intrusion Detection Systems (IDS), rely on identifying connections to known malicious domains or IP addresses. Because MythicRatatoskr operates within a mesh network where any node can potentially act as a relay, blocking a single C&C address is often insufficient. Defenders must now consider the broader network infrastructure of the mesh itself. As identified by this research, blocking access to known public Yggdrasil peers is a viable mitigation, but it remains a cat-and-mouse game.

The Shift in "Initial Access"

The role of UAC-0099 as an "Initial Access Broker" (IAB) for state-aligned actors is a concerning trend. By outsourcing the initial breach to smaller, specialized groups, major state-sponsored actors like Sandworm can reduce their own exposure during the early stages of an attack. This complicates attribution, as investigators may initially see only the lower-level TTPs of the access broker, missing the presence of the far more dangerous threat actor waiting in the wings.

Official Responses and Recommendations

Findings regarding MythicRatatoskr were presented at the 2026 LABScon and Virus Bulletin conferences to ensure the global security community is equipped to detect this threat. Organizations operating in sectors targeted by these groups—particularly energy, logistics, and government—are advised to implement the following:

1. Network Monitoring: Monitor for traffic patterns associated with the Yggdrasil network, particularly in the 200::/7 subnet range.
2. Endpoint Security: Deploy EDR (Endpoint Detection and Response) solutions that can flag suspicious scheduled tasks and the execution of unauthorized binaries in temporary directories.
3. Governance: Restrict the use of administrative tools like SDelete or PowerShell within production environments unless explicitly authorized.
4. Credential Hygiene: Given the use of spearphishing as the primary vector, robust multi-factor authentication (MFA) and aggressive email filtering remain the most effective defenses against initial compromise.

Conclusion

The collaboration between UAC-0099 and Sandworm, combined with the deployment of the highly resilient MythicRatatoskr backdoor, represents a significant escalation in the sophistication of state-sponsored cyber warfare. The move toward decentralized mesh networking as a primary C&C channel highlights the adaptability of these actors. As we look toward the future, the defense of critical infrastructure must evolve to match the increasing decentralization and complexity of adversary infrastructure. The MythicRatatoskr incident serves as a stark reminder that in the modern threat landscape, the "tree of knowledge" of cyber-adversaries is constantly growing new,, more complex branches.