Researchers have revealed that the Russian hacking group Sandworm, in collaboration with another threat actor, executed a destructive cyberattack against a Ukrainian grain logistics company. This attack unfolded in July 2025 when UAC-0099, a Russian-aligned espionage group, infiltrated the company's systems via a phishing email with a malicious attachment, as reported by Slovak cybersecurity firm ESET. After gaining access, the hackers installed a backdoor named MatchWok to maintain their foothold in the network. They later deployed a novel tool called MythicRatatoskr, which enabled them to execute remote commands, steal files, and capture screenshots.
ESET's investigation showed that UAC-0099 likely transferred access to Sandworm, which is linked to Russia's military intelligence service, GRU. In September, Sandworm conducted a data-wiping attack on the company. Although ESET could not definitively identify which group primarily operated the newly discovered backdoor, the attack highlighted a unique method of concealing communications. Instead of using a conventional server, the malware communicated via Yggdrasil, a decentralized network facilitating encrypted data exchange without a central hub. This marks the first known instance of Yggdrasil's abuse by a state-aligned threat actor.
UAC-0099 has a history of targeting various Ukrainian sectors, including government, finance, media, transportation, manufacturing, and energy. Sandworm, notorious for its operations against critical infrastructure, has previously caused power outages in Ukraine and attempted attacks on the country's energy sector. The group has frequently deployed data-wiping malware against Ukrainian targets. Unlike ransomware, this malware aims to destroy data permanently and disrupt operations.
ESET's findings illustrate ongoing cooperation between Russian hacking groups. Earlier in 2025, they identified coordinated attacks by Russia-linked groups Gamaredon and Turla against Ukrainian organizations. This collaboration between UAC-0099 and Sandworm underscores a pattern of coordinated cyber operations targeting Ukraine's critical sectors.
