MythicRatatoskr: How UAC-0099 and Sandworm Used a Decentralized Mesh Network to Destroy a Ukrainian Logistics Firm
Executive Summary
On July 16, 2025, Russia-aligned threat group UAC-0099 gained initial access to a Ukrainian grain logistics company via a spearphishing email delivering the MATCHWOK backdoor. Within 24 hours, a previously undocumented Go-based implant named MythicRatatoskr was deployed, routing its command-and-control traffic covertly through the Yggdrasil decentralized mesh network—the first documented abuse of this experimental peer-to-peer infrastructure by a state-aligned actor. UAC-0099 subsequently handed off access to Sandworm (GRU Unit 74455), which on September 17, 2025 executed a destructive data-wiping attack using the SDelete utility pushed via Active Directory Group Policy, permanently destroying data across the organization.
This incident underscores a maturing pattern of operational collaboration among Russia-aligned APT groups, where specialized initial-access actors broker footholds to destructive-capability teams. The novel use of Yggdrasil for C2 concealment signals a broader adversarial trend toward experimental peer-to-peer and decentralized overlay networks to evade traditional perimeter and egress security controls, raising urgent detection and policy-enforcement challenges for defenders worldwide.
Why This Matters Now
State-aligned threat actors are actively experimenting with decentralized mesh networks like Yggdrasil to hide C2 infrastructure, rendering conventional IP-reputation blocking and perimeter egress controls ineffective. Combined with the documented UAC-0099-to-Sandworm access handoff model—mirroring the earlier Gamaredon-Turla collaboration—organizations in critical infrastructure, logistics, and government sectors face compounding risk from multi-actor coordinated campaigns that blend espionage staging with destructive wiping payloads, with Ukraine and allied supply-chain partners as primary targets.
Attack Path Analysis
UAC-0099 gained initial access to a Ukrainian grain logistics company on July 16, 2025 via a spearphishing email with a malicious attachment, deploying the MATCHBOIL downloader and MATCHWOK backdoor. The following day, MythicRatatoskr — a Go-based backdoor leveraging the Yggdrasil decentralized mesh network for C2 — was deployed, persisted as a Windows service, and subsequently used to spread laterally via OpenSSH SFTP to additional machines and deploy a SOCKS5 proxy server. C2 communications were tunneled through the Yggdrasil overlay network using end-to-end encrypted HTTPS, making detection exceptionally difficult. Files and screenshots were exfiltrated to the Yggdrasil-hosted C2 server over two months of dwell time. Sandworm ultimately received the handoff and executed a destructive data-wiping attack on September 17, 2025 using SDelete deployed via Active Directory Group Policy.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
UAC-0099 delivered a spearphishing email with a malicious attachment to a grain logistics company in Ukraine on July 16, 2025. Execution of the attachment triggered a scheduled task (pdfopentask) that ran a PowerShell payload, leading to deployment of the MATCHBOIL downloader and subsequently the MATCHWOK backdoor, which beaconed to https://uztickets[.]com and downloaded further payloads from https://egyptanimals[.]com.
MITRE ATT&CK® Techniques
Phishing: Spearphishing Attachment
Create or Modify System Process: Windows Service
Command and Scripting Interpreter: Windows Command Shell
Proxy: Multi-hop Proxy
Encrypted Channel: Asymmetric Cryptography
Obfuscated Files or Information: Encrypted/Encoded File
Data Destruction
Exfiltration Over C2 Channel
Screen Capture
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Ingress Tool Transfer
Domain or Tenant Policy Modification: Group Policy Modification
Application Layer Protocol: Web Protocols
Proxy: Internal Proxy
Valid Accounts
Data from Local System
Data Encoding: Standard Encoding
Masquerading: Match Legitimate Name or Location
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIS2 Directive (EU) 2022/2555 – Mandatory Cybersecurity Risk Management for Essential Entities
Control ID: Article 21 – Cybersecurity Risk Management Measures
DORA (EU) 2022/2554 – Digital Operational Resilience Act – ICT Incident Classification, Reporting, and Response
Control ID: Article 17 – ICT-related Incident Management Process
CISA Zero Trust Maturity Model 2.0 – Network Traffic Visibility and Segmentation Controls
Control ID: Network Pillar – Macro/Micro Segmentation and Traffic Filtering
NIST SP 800-53 Rev. 5 – Malware Protection, System Monitoring, Incident Response, and Remote Access Controls
Control ID: SI-3, SI-4, IR-4, AC-17
ISO/IEC 27001:2022 – Malware Controls, Monitoring, Incident Response, and Web Filtering
Control ID: Annex A 8.7, 8.16, 5.26, 8.23
PCI DSS v4.0 – Vulnerability Management, Audit Logging, and Incident Response Plan
Control ID: Requirement 6.3, 10.3, 12.10
GDPR (EU) 2016/679 – Technical Security Measures and Breach Notification Obligations
Control ID: Article 32 – Security of Processing; Article 33 – Notification of Personal Data Breach
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Transportation
Ukrainian grain logistics operator was directly targeted by UAC-0099/Sandworm APT wiper collaboration, with MythicRatatoskr backdoor enabling lateral movement and SDelete-based data destruction across operational systems.
Government Administration
UAC-0099 targets Ukrainian governmental organizations using spearphishing and MATCHWOK backdoors; Sandworm's Active Directory Group Policy abuse for SDelete deployment threatens critical administrative infrastructure and state data integrity.
Financial Services
UAC-0099 explicitly profiles financial institutions for espionage pre-staging; MythicRatatoskr's encrypted Yggdrasil C2 channel and SOCKS5 proxy pivot evade egress controls, risking exfiltration of sensitive financial data.
Information Technology/IT
Yggdrasil mesh-based C2 bypasses conventional network visibility and egress security controls; IT infrastructure faces persistent backdoor deployment, east-west lateral movement, and zero-trust segmentation failures across hybrid environments.
Sources
- MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaborationhttps://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/Verified
- CERT-UA Advisory on UAC-0099 MATCHBOIL/MATCHWOK Activityhttps://cert.gov.ua/article/6284949Verified
- CERT-UA First Report on UAC-0099https://cert.gov.ua/article/4818341Verified
- MATCHBOIL: New tricks, same old evil intentions - ESET Researchhttps://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/Verified
- Sandworm: A Tale of Disruption Told Anew - ESET Researchhttps://www.welivesecurity.com/2022/03/21/sandworm-tale-disruption-told-anew/Verified
- Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware - US DOJhttps://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-andVerified
- Industroyer2: Industroyer Reloaded - ESET Researchhttps://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/Verified
- MythicRatatoskr IoCs and Samples - ESET GitHub Repositoryhttps://github.com/eset/malware-ioc/tree/master/mythicratatoskrVerified
- Gamaredon X Turla Collaboration - ESET Researchhttps://www.welivesecurity.com/en/eset-research/gamaredon-x-turla-collab/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because UAC-0099 exploited unrestricted outbound access, unconstrained east-west paths, and unmonitored overlay network traffic to sustain two months of dwell time before a destructive wipe. Enforcing workload-level segmentation and identity-aware egress controls would likely have reduced the attacker's reachability across the environment and constrained the blast radius available to Sandworm during the final destructive phase.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Outbound connectivity from workloads to unrecognized external domains like uztickets[.]com and egyptanimals[.]com would likely be constrained, reducing the ability of the initial payload to successfully call home and retrieve staged components.
Control: Zero Trust Segmentation
Mitigation: Strict workload-level segmentation would likely constrain what network-accessible resources an escalated session could reach, limiting how far elevated privileges could translate into broader network access across additional workloads or services.
Control: East-West Traffic Security
Mitigation: East-west policy enforcement would likely constrain SSH and SFTP reachability between workloads that have no defined need to communicate, reducing the attacker's ability to freely pivot to additional machines using OpenSSH SFTP and deploy additional backdoor instances.
Control: Multicloud Visibility & Control
Mitigation: Centralized visibility across egress paths would likely surface anomalous outbound connections toward unfamiliar IPv6 destinations and decentralized overlay peers, giving defenders better opportunity to identify and constrain Yggdrasil-based C2 traffic that would otherwise blend into normal HTTPS flows.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress enforcement would likely reduce the volume and consistency of outbound data flows to Yggdrasil overlay destinations, as workloads with no legitimate reason to establish outbound HTTPS to decentralized mesh IPv6 peers could be constrained from doing so.
Had prior segmentation controls constrained lateral movement and east-west reachability throughout the dwell period, the number of hosts accessible to Sandworm at the time of the handoff would likely have been smaller, reducing the scope of systems reachable via Group Policy-driven wiper deployment.
Impact at a Glance
Affected Business Functions
- Grain Logistics and Supply Chain Operations
- Operational Data and Fleet/Cargo Management Systems
- Corporate IT Infrastructure and Active Directory Services
- Agricultural Trade Documentation and Shipment Records
Estimated downtime: 21 days
Estimated loss: N/A
The victim, a Ukrainian grain logistics company, suffered a confirmed data-wiping attack executed by Sandworm on September 17, 2025, approximately two months after initial compromise on July 16, 2025. During the dwell period, MythicRatatoskr was used to exfiltrate files and screenshots from compromised machines, with operators having access to the current user context, hostname, local network configurations, file system contents, and screen captures. Data at risk includes operational logistics records, cargo manifests, shipment tracking data, internal communications, employee information, financial transaction records related to grain trade, and corporate network topology details. The data-wiping attack using SDelete via Active Directory Group Policy resulted in irreversible destruction of data across multiple machines within the organization. The extended two-month reconnaissance phase suggests significant volumes of sensitive business and operational intelligence were exfiltrated prior to the destructive phase.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Multicloud Visibility & Control with anomaly baselining: MythicRatatoskr's C2 operated over Yggdrasil mesh using public peer addresses on port 443/TLS — CNSF multicloud visibility with traffic observability and centralized policy enforcement would surface unexpected outbound TLS connections to 200::/7 IPv6 addresses or known Yggdrasil public peer IPs, enabling early C2 detection during the two-month dwell period.
- • Enforce Egress Security & Policy with FQDN/IP filtering: Blocking outbound connections to known Yggdrasil public peer addresses (all 32 hardcoded peers are identifiable) via CNSF egress security and outbound firewall policy enforcement would sever MythicRatatoskr's ability to join the mesh network, preventing C2 establishment and file exfiltration over the covert overlay channel.
- • Apply Zero Trust Segmentation to contain lateral movement: MythicRatatoskr spread to additional machines via OpenSSH SFTP and deployed a SOCKS5 proxy to tunnel deeper network access — CNSF microsegmentation with identity-based policy and least-privilege east-west controls would have restricted workload-to-workload SFTP access and blocked unauthorized internal proxy traffic between compromised hosts.
- • Instrument East-West Traffic Security to detect internal pivoting: The deployment of a SOCKS5 proxy server listening on 127.0.0.1:33690 with Yggdrasil-based port forwarding represents internal traffic tunneling — CNSF east-west traffic inspection with service-to-service flow monitoring would detect anomalous proxy listener behavior and inter-host tunneling patterns inconsistent with legitimate grain logistics workloads.
- • Leverage Inline IPS (Suricata) signatures for known Yggdrasil peer traffic and MATCHBOIL/MATCHWOK payload patterns: Initial compromise relied on known UAC-0099 malware (MATCHBOIL downloader, MATCHWOK backdoor) with documented C2 domains — CNSF inline IPS with updated threat signatures covering these IoCs and Yggdrasil peer TLS fingerprints would detect and block malicious payloads at delivery and C2 establishment phases before MythicRatatoskr deployment.
