MythicRatatoskr & Yggdrasil: How Sandworm Used a Mesh Network Backdoor to Wipe Ukrainian Infrastructure
Executive Summary
In July 2025, Russian-aligned threat actor UAC-0099 (aka Earth Sirrush) gained initial access to a Ukrainian logistics company via a spear-phishing email deploying the MATCHWOK backdoor. A day later, the group introduced a previously undocumented implant called MythicRatatoskr, which routed command-and-control traffic through the Yggdrasil peer-to-peer mesh network to evade detection. Over two months later, on September 17, 2025, UAC-0099 handed off access to Sandworm, which executed a destructive data-wiping attack using the SDelete utility pushed via Active Directory Group Policy—destroying operational data across the compromised environment.
This incident marks the first documented abuse of the Yggdrasil mesh network by a state-aligned threat actor for C2 infrastructure, signaling a new evasion frontier. The coordinated handoff between UAC-0099 and Sandworm reflects a maturing division-of-labor model among Russian APT groups, raising the operational risk bar for critical infrastructure defenders globally.
Why This Matters Now
Russian APT collaboration is accelerating: UAC-0099 now functions as an access broker feeding Sandworm validated targets for destruction. The use of decentralized mesh networks like Yggdrasil for C2 makes traditional perimeter and DNS-based detection ineffective. With similar TTPs being applied across energy, logistics, and government sectors, organizations relying on legacy network monitoring face an urgent blind spot that zero trust segmentation and anomaly-based east-west traffic inspection must urgently address.
Attack Path Analysis
UAC-0099 gained initial access to a Ukrainian logistics company on July 16, 2025 via a spear-phishing email with a malware-laced attachment, deploying the MATCHBOIL downloader and then the MATCHWOK backdoor, followed a day later by the MythicRatatoskr backdoor which communicated covertly over the Yggdrasil peer-to-peer mesh network. Over two months of persistent dwell time, the actor escalated privileges, moved laterally across the Windows environment, handed off access to Sandworm, and ultimately triggered a destructive data-wiping attack on September 17, 2025 using SDelete deployed via Active Directory Group Policy.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
UAC-0099 delivered a spear-phishing email with a malicious attachment to a Ukrainian logistics company employee on July 16, 2025. The attachment triggered execution of the MATCHBOIL downloader, which subsequently fetched and deployed the MATCHWOK backdoor, establishing the initial foothold on a Windows endpoint.
MITRE ATT&CK® Techniques
Phishing: Spearphishing Attachment
Ingress Tool Transfer
Proxy: Internal Proxy
Proxy: Multi-hop Proxy
Screen Capture
Command and Scripting Interpreter: Windows Command Shell
Domain or Tenant Policy Modification: Group Policy Modification
Data Destruction
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIS2 Directive (EU) 2022/2555 – Incident Handling and Business Continuity
Control ID: Article 21(2)(b) and 21(2)(e)
DORA (EU) 2022/2554 — Digital Operational Resilience Act – ICT Incident Detection and Resilience Testing
Control ID: Article 10 — ICT-related Incident Management and Article 13 — Testing of ICT Tools
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Network Micro-Segmentation and Lateral Movement Prevention
Control ID: Network Pillar — Pillar 3: Network Segmentation and Traffic Filtering; Identity Pillar — Pillar 1: Identity Verification
NIST SP 800-53 Rev. 5 – Malware Defense, Continuous Monitoring, and Network Boundary Controls
Control ID: SI-3 (Malicious Code Protection), SI-4 (System Monitoring), IR-4 (Incident Handling), SC-7 (Boundary Protection)
ISO/IEC 27001:2022 – Malware Protection, Security Monitoring, and Incident Response
Control ID: Annex A 8.7 (Protection Against Malware), A 8.16 (Monitoring Activities), A 5.26 (Response to Information Security Incidents)
PCI DSS 4.0 – Anti-Malware Efficacy, Control Failure Detection, and IR Preparedness
Control ID: Requirement 5.2 (Anti-Malware), Requirement 10.7 (Failure of Security Controls Detection), Requirement 12.10 (Incident Response Plan)
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Transportation
Ukrainian logistics firm targeted by Sandworm wiper attack via MythicRatatoskr backdoor; lateral movement and data destruction via SDelete expose critical supply chain and freight operations to APT espionage threats.
Government Administration
Sandworm APT collaboration with UAC-0099 targets government entities using spear-phishing and mesh-network C2; zero trust segmentation and east-west traffic controls are critical to limiting privilege escalation and destructive wiper deployment.
Oil/Energy/Solar/Greentech
Energy sector explicitly named among Sandworm-UAC-0099 campaign targets; Yggdrasil-based C2 resilience and SDelete wiper via Group Policy pose severe operational disruption risks requiring egress security and multicloud visibility controls.
Logistics/Procurement
Direct victim sector in documented attack; encrypted peer-to-peer C2 via Yggdrasil and SOCKS5 proxy tunneling evade standard detection, demanding east-west traffic security and anomaly response to prevent data exfiltration and destruction.
Sources
- Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attackhttps://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.htmlVerified
- MythicRatatoskr: Yggdrasil-Enabled Backdoor Deployed in UAC-0099 and Sandworm Collaborationhttps://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/Verified
- CERT-UA Advisory on UAC-0099 Targeting Ukrainian Organizationshttps://cert.gov.ua/Verified
- ESET APT Activity Report Q2 2025-Q3 2025https://www.welivesecurity.com/en/eset-research/eset-apt-activity-report-q2-2025-q3-2025/Verified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Sandworm Team - MITRE ATT&CK Group G0034https://attack.mitre.org/groups/G0034/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because UAC-0099 relied on unrestricted east-west movement, uncontrolled egress paths, and open outbound connectivity to sustain two months of dwell time before handing off access to Sandworm. Enforcing workload-level segmentation and identity-aware routing policies would likely have reduced attacker reachability across the logistics environment and constrained the blast radius well before the destructive wiping phase.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The workload's ability to initiate unsanctioned outbound connections to retrieve the MATCHWOK payload would likely be constrained by fabric-level policy, reducing the chance that MATCHBOIL could successfully complete its download-and-deploy sequence.
Control: Zero Trust Segmentation
Mitigation: Strict workload segmentation would likely reduce the scope of lateral identity reuse, making it harder for the attacker to pivot privileged credentials across isolated segments and limiting how far domain-level access could propagate through the environment.
Control: East-West Traffic Security
Mitigation: East-west enforcement policies would likely constrain the attacker's ability to route SOCKS5 proxy traffic across internal segments, reducing how many internal hosts could be reached from the initially compromised endpoint and narrowing the pivot surface available to both UAC-0099 and Sandworm.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic visibility across the environment would likely surface anomalous outbound patterns associated with Yggdrasil mesh connectivity, and policy enforcement could reduce the reachability of the C2 channel by constraining which workloads are permitted to initiate encrypted sessions to unrecognized peer network destinations.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress policies would likely reduce the volume of data that could be exfiltrated by constraining which workloads are permitted to send outbound data to unrecognized external destinations, making sustained file transfers through the Yggdrasil channel harder to complete without detection or policy intervention.
Had prior segmentation and egress controls constrained attacker movement and reduced reachable AD infrastructure, the scope of GPO-delivered SDelete execution would likely have been limited to fewer systems, reducing the overall data destruction footprint rather than allowing a domain-wide wipe.
Impact at a Glance
Affected Business Functions
- Freight and Supply Chain Operations
- Warehouse and Inventory Management Systems
- Enterprise IT Infrastructure and Active Directory Services
- Transportation Routing and Logistics Coordination
Estimated downtime: 21 days
Estimated loss: N/A
The attack involved a two-phase intrusion spanning over two months. During the espionage phase conducted by UAC-0099, sensitive operational data including shipment manifests, routing schedules, client contracts, and potentially personnel records were at risk of exfiltration via the MythicRatatoskr backdoor. The subsequent Sandworm-executed data-wiping attack using SDelete via Active Directory Group Policy likely resulted in permanent destruction of critical business data across Windows endpoints, including operational databases, communications archives, and logistics planning documents. Given the logistics sector context and Ukraine-focused targeting pattern, intelligence value of exfiltrated data related to military or government supply chains is assessed as high. Financial loss figures are not publicly confirmed but sector-average estimates for destructive wiper incidents in logistics range from $2M to $15M USD when accounting for recovery, downtime, and data reconstruction costs.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy East-West Traffic Security controls to detect and block the SOCKS5 proxy lateral movement technique used by MythicRatatoskr; workload-to-workload segmentation policies aligned with ZTMM.Network and NIST.800-53.SC-7 would have contained the actor's internal pivoting and prevented the access handoff to Sandworm.
- • Enforce Zero Trust Segmentation with least-privilege identity-based policy to restrict which endpoints and identities can modify Active Directory Group Policy Objects; microsegmentation aligned with ZTMM.Network and NIST.800-53.AC-6 would have blocked Sandworm's ability to deploy SDelete organization-wide via GPO.
- • Enable Multicloud Visibility and Control with anomaly-based traffic baselining to detect the unusual peer-to-peer Yggdrasil mesh C2 traffic pattern and the 10-minute delayed startup behavior; centralized traffic observability mapped to ZTMM.CrossCutting.Visibility and NIST.800-53.AU-6 would have flagged the novel C2 channel before the extended dwell period reached impact.
- • Apply Egress Security and Policy Enforcement with FQDN and destination filtering to prevent MythicRatatoskr's outbound connections to Yggdrasil mesh network nodes; egress controls aligned with ZTMM.Data and NIST.800-53.SC-18 would have disrupted C2 communication and blocked file exfiltration over unauthorized outbound channels.
- • Leverage Encrypted Traffic controls (HPE) and Cloud Firewall (ACF) egress inspection to detect unencrypted or anomalous outbound data transfers used during the exfiltration phase; combining internet egress control with traffic observability aligned to PCI.4.0.6.4.3 and NIST.CSF.DE.CM-8 would have identified and blocked data uploads to the Yggdrasil-hosted C2 before the destructive wiper stage was reached.
