The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.
According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of the MATCHWOK backdoor via a downloader called MATCHBOIL.
The activity ultimately culminated with the threat actor handing off access to Sandworm, which then conducted a data-wiping attack on September 17, 2025, more than two months after it obtained a foothold.
What makes the attack stand out is UAC-0099’s use of a previously undocumented backdoor called MythicRatatoskr that communicates with a command-and-control (C2) server hosted inside the Yggdrasil mesh network. The backdoor was deployed a day after MATCHWOK was executed.
There are indications that development on the backdoor started sometime between December 2024 and February 2025. Its functionality is fairly straightforward in that it sends victim metadata to the C2 server, poll for new commands, transmit command output, take screenshots, and upload/download files.
It can also alter the current working directory, enumerate directory contents, change the C2 server URL, execute a shell command via “cmd.exe,” and spawn a reverse SOCKS5 proxy. In addition, some artifacts include a 10-minute startup delay in a likely effort to avoid immediately connecting to the Yggdrasil network and evade detection.
“To our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor, and it may signal a broader trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure,” ESET researchers Anton Cherepanov and Peter Strýček said.
MythicRatatoskr is said to have been used to deploy a SOCKS5 server to route connections through the compromised network. The attack culminated with Sandworm carrying out a data-wiping attack by dropping the SDelete utility via Active Directory Group Policy. It’s worth noting that the Sandworm-linked NikoWiper malware is also derived from SDelete.
 |
| Yggdrasil map with the C&C serve |
While the attack investigated by ESET compromised a Windows system, source code references to “crond” within MythicRatatoskr suggest there possibly exists an equivalent Linux version of the malware.
The assessment that UAC-0099 is likely collaborating with Sandworm is not new. In its APT Activity Report Q2 2025–Q3 2025, ESET said it observed UAC-0099 conducting initial access operations and subsequently transferring “validated targets” to Sandworm for further post-exploitation.
These attacks targeted government, energy, logistics, and grain sectors in Ukraine, the Slovak cybersecurity company noted at the time.
This sort of cooperation between Russia-aligned actors is also not new. Last year, ESET said it identified evidence that Gamaredon and Turla were working together to target and co-compromise Ukrainian entities, with one intrusion leveraging Gamaredon’s PteroGraphin to deploy Turla’s Kazuar backdoor.
Furthermore, a Gamaredon-linked downloader called Pterodo has been used to retrieve and execute InvisiMole, a modular spyware program put to use against targets in Ukraine and Russia.
“This kind of cooperation underscores the potential for coordinated cyber espionage campaigns among Russia-aligned groups, likely intended to amplify their operational impact,” ESET said.
