MythicRatatoskr backdoor hid in Yggdrasil mesh before Sandworm wiped Ukrainian grain firm
ESET says UAC-0099 deployed a new Go backdoor using the Yggdrasil mesh network for C&C and handed access to Sandworm, which wiped data at a Ukrainian grain logistics company.
At a glance
- UAC-0099 breached a Ukrainian grain logistics firm via spearphishing in July 2025 and deployed the previously unknown MythicRatatoskr backdoor.
- The Go backdoor reaches a C&C server hosted inside the Yggdrasil mesh network, which ESET calls likely the first documented state-aligned abuse of Yggdrasil.
- Sandworm wiped data on September 17, 2025, deploying SDelete through Active Directory Group Policy.
- ESET says blocking public Yggdrasil peers is a viable mitigation, as the traffic may otherwise evade network security tools.
ESET researchers said on October 22 that two Russia-aligned threat groups worked together to destroy data at an unnamed Ukrainian grain logistics company in 2025, with UAC-0099 acting as an initial access broker for Sandworm. In the process, the attackers deployed MythicRatatoskr, a previously undocumented Go backdoor that hides its command-and-control server inside the Yggdrasil decentralized mesh network.
What happened
According to ESET, the intrusion began in July 2025 with a spearphishing email carrying a malicious attachment. On July 16, a scheduled task ran a PowerShell payload that deployed the MATCHBOIL downloader, which in turn fetched the MATCHWOK backdoor. A MythicRatatoskr binary arrived on July 17, and in August further samples spread to other machines, apparently through an OpenSSH SFTP server.
On September 17, 2025, the data-wiping stage followed: ESET said the SDelete utility was pushed through Active Directory Group Policy, a method it links to previous Sandworm operations. The Record noted that Sandworm, tied by Western intelligence to Russia's GRU, is associated with the 2015 and 2016 power outages in Ukraine.
ESET said it has high confidence in the UAC-0099 initial access, the Sandworm wiping and the handoff between them, but could not determine which group operated MythicRatatoskr. It rates UAC-0099's alignment with Russia at medium confidence.
Technical details
MythicRatatoskr runs as a Windows service named ieupdate and supports shell commands through cmd.exe, file upload and download, screenshots, configuration changes and a reverse SOCKS5 proxy. Its configuration is encrypted with AES-256-CFB. ESET noted a configuration path hinting that a Linux or Unix variant may exist.
Yggdrasil is an experimental, end-to-end encrypted IPv6 mesh network. The backdoor embeds a list of 32 public peers, picks three at random and connects to a C&C server inside the mesh over HTTPS on port 443, generating a new Yggdrasil address on each run. ESET described this as likely the first documented abuse of Yggdrasil in this way by a state-aligned actor, and The Record noted it could make attacker infrastructure harder to trace.
What to do
ESET says blocking the public Yggdrasil peer addresses is a viable mitigation, since such traffic may otherwise slip past network security tools. Defenders can also hunt for the ieupdate service, .updatecache configuration files and SDelete execution distributed through Group Policy. ESET detects the backdoor as WinGo/Agent.ZO and has published the full indicator list, including the domains uztickets[.]com and egyptanimals[.]com, on its GitHub repository.
Sources
This story is based on the sources listed above. Always check the vendor’s official advisory before acting on critical systems.
