Cyberattacks against Ukrainian grain logistics companies have revealed the existence of a previously unknown backdoor known as MythicRatatoskr, which is associated with Russia-aligned hacking groups UAC-0099 and Sandworm, both of which appear to have participated separately in the intrusion and destructive activity.
As reported by cybersecurity researchers at ESET, the incident began in July of 2025 and ultimately resulted in a data-wiping attack that disrupted the targeted organization in September.
Based on the investigation, UAC-0099 was first able to gain access to the company's network on July 16, 2025, by sending spear-phishing emails containing malicious attachments.
Attackers established a foothold and deployed additional malware by using their existing malware tools, including the MATCHBOIL downloader and the MATCHWOK backdoor. The following day, MythicRatatoskr was introduced, allowing operators to control compromised systems in a new manner.
A Go-based application, Mythic Ratatoskr provides remote command execution, file transfers, file system navigation, and screenshot captures.
Additionally, researchers discovered that the backdoor could establish proxy connections, allowing attackers to route communications through a compromised network if the backdoor were used. As part of its command-and-control system (C2), the malware can transfer files to the command-and-control server, obtaining information about infected systems, including usernames, hostnames, and local network details.
Yggdrasil Network Used for Command-and-Control Communications
It was noteworthy that MythicRatatoskr used the Yggdrasil mesh network to communicate with its C2 infrastructure, one of the most significant findings. By connecting a backdoor directly to the server within this decentralized network Yggdrasil, devices are able to communicate through a secure IPv6 overlay without relying on a central hub, instead of using conventional servers directly accessible over the internet.
In spite of its legitimate applications, the network's decentralized architecture can facilitate the development of malicious infrastructure, complicating efforts to locate or disrupt command-and-control operations, and improving infrastructure resilience. According to ESET researchers, this is the first documented instance of state-aligned threat actors utilizing Yggdrasil for such purposes.
A Linux version of MythicRatatoskr may also exist, although its deployment has not been confirmed by researchers. Its capabilities and network design indicate that the backdoor was designed to maintain remote access and support further activity within the compromised environment. In the course of the intrusion, researchers also observed a SOCKS5 proxy server, which may have been deployed through affected systems using MythicRatatoskr.
It is unclear who is responsible for operating the backdoor.
While ESET attributed the initial compromise and the associated malware deployment with high confidence to UAC-0099, a subsequent investigation revealed that Sandworm had taken over access. Based on techniques consistent with Sandworm's previous operations, later destructive activity was attributed to Sandworm.
A draggable item can be picked up by pressing the space bar. While dragging, use the arrow keys to move the item. Press space again to drop the item in the new position, or press escape to cancel the action.
Cooperation Between Russia-Linked Groups Highlights Wider Threat
It is evident that the incident reflects a pattern of cooperation among Russian-allied threat actors. In earlier investigations, ESET found evidence that Gamaredon and Turla, both associated with the Russian Federal Security Service, coordinated attacks against Ukrainian organizations.
As demonstrated by the suspected transfer of access from UAC-0099 to Sandworm in the MythicRatatoskr case, there may be a similar division of responsibilities, with one group establishing an initial foothold while the other group executing destructive activities.
A cyberattacker known as UAC-0099 has been targeting Ukrainian government agencies, financial institutions, and media organizations since at least 2022.
Based on ESET's assessment, it is possible that the group will serve as an initial access group for Sandworm, which is widely attributed to Russia's military intelligence agency, the GRU. The unit, 74455, is known for its destructive cyber operations.
It is known for attacks on the Ukrainian power grid in 2015 and 2016, the NotPetya data-wiping campaign in 2017 as well as the Olympic Destroyer attack in 2018.
Since Russian forces invaded Ukraine on a full scale in 2022, the group has continued to use data-wiping malware against strategic organizations.
An incident in September 2025 occurred in which Sandworm erased data through Active Directory Group Policy using Microsoft's SDelete utility, a method consistent with its previous observations.
Unlike ransomware, which typically encrypts files to demand payment, data wipers are designed to destroy information and disrupt affected systems rather than encrypting files.
Research has linked the initial intrusion with UAC-0099, and the subsequent wiping activity with Sandworm, but the exact division of responsibility for MythicRatatoskr remains unclear.
In addition to raising concerns about the use of decentralized networking technologies in targeted cyberattacks, ESET has not confirmed whether UAC-0099 or Sandworm operated the backdoor primarily.
It is important to note that Yggdrasil was developed for legitimate networking purposes and does not provide anonymity; nevertheless, its architecture can complicate the search for malicious command-and-control infrastructure.
ESET's findings represent the first documented instance of a state-aligned threat actor using the network in this manner, highlighting a growing tendency to conceal communications during attacks on Ukrainian organizations by maintaining access and concealing communications.
