ESET Links Sandworm to Yggdrasil-Backed Attack on Ukrainian Logistics
ESET has detailed a destructive intrusion against a Ukrainian logistics company in which the Russia-linked Sandworm group ultimately wiped data after another threat actor, UAC-0099, established access. The operation began on July 16, 2025, with a spear-phishing email carrying a malicious attachment, and culminated on September 17, 2025, when Sandworm deployed a wiping mechanism more than two months after the initial compromise.
The investigation identifies a previously undocumented backdoor, MythicRatatoskr, as a notable component of the intrusion. The malware communicated with a command-and-control server hosted within the Yggdrasil mesh network, a peer-to-peer networking system. ESET said this is the first documented case of a state-aligned actor abusing Yggdrasil in this manner.
Initial access and handoff to Sandworm
UAC-0099, also known as Earth Sirrush, obtained initial access by phishing the Ukrainian organisation. The malicious attachment led to the deployment of the MATCHWOK backdoor through a downloader named MATCHBOIL. MythicRatatoskr was deployed one day after MATCHWOK executed.
ESET assessed that UAC-0099 transferred access to Sandworm after validating the target. Its earlier reporting described UAC-0099 conducting initial-access operations and passing validated targets to Sandworm for further post-exploitation. The activity observed by ESET targeted Ukrainian government, energy, logistics and grain sectors.
The final destructive stage used the SDelete utility, delivered through Active Directory Group Policy. Sandworm used it to wipe data from the compromised environment. ESET also noted that the Sandworm-linked NikoWiper malware is derived from SDelete.
Why the Yggdrasil connection matters
MythicRatatoskr can send victim metadata to its command-and-control server, poll for commands and return command output. Its capabilities include taking screenshots, uploading and downloading files, changing the working directory, listing directory contents, changing the command-and-control URL and running shell commands through cmd.exe.
The backdoor can also create a reverse SOCKS5 proxy. ESET said it was used to deploy a SOCKS5 server capable of routing connections through the compromised network. Some samples delay startup by 10 minutes, a design choice that may help avoid an immediate connection to Yggdrasil and evade detection.
Development of MythicRatatoskr appears to have started between December 2024 and February 2025. Although ESET investigated a Windows compromise, references to crond in the malware source code suggest that a Linux version may also exist.
Implications for defenders
The incident shows how access brokers and destructive operators can divide responsibilities across a long-running intrusion. It also illustrates how nontraditional peer-to-peer infrastructure may be incorporated into command-and-control operations alongside familiar phishing, remote access and Active Directory abuse.
Security teams should treat phishing-resistant access controls, monitoring for unusual proxy behaviour and investigation of unexpected mesh-network traffic as complementary measures. They should also review who can modify Group Policy and how software-distribution paths are monitored, because those controls can determine whether an established foothold becomes a destructive enterprise-wide event.