A recent investigation by ESET has unveiled a complex cyber assault involving the Russian state-sponsored hacking group Sandworm and another threat actor, identified as UAC-0099, against a Ukrainian logistics company. The attack unfolded when UAC-0099 gained initial access on July 16, 2025, using a spear-phishing email that included a malicious attachment. This led to the deployment of the MATCHWOK backdoor through a downloader known as MATCHBOIL. The operation concluded with Sandworm executing a data-wiping attack on September 17, 2025, after taking over from UAC-0099.

The standout feature of this attack was the use of a previously undocumented backdoor named MythicRatatoskr. This backdoor interacts with a command-and-control server hosted within the Yggdrasil mesh network. It was deployed shortly after the MATCHWOK execution, showcasing its ability to send victim metadata to the server, request new commands, transfer command outputs, and manage files. It can also execute shell commands and establish a reverse SOCKS5 proxy, among other capabilities. A notable artifact is its 10-minute startup delay, likely an evasion tactic to avoid immediate detection.

This instance marks the first known use of Yggdrasil by a state-aligned threat actor, suggesting a potential trend towards using experimental peer-to-peer networks to enhance stealth and resilience. MythicRatatoskr was also used to deploy a SOCKS5 server, routing connections through the compromised network. Sandworm ultimately conducted the data-wiping attack using the SDelete utility, with links to their NikoWiper malware.

The attack mainly impacted a Windows environment, but references to Linux suggest a potential equivalent version of the malware. This collaboration between UAC-0099 and Sandworm is part of a broader pattern of cooperation among Russia-aligned groups, as evidenced in past cases involving Gamaredon and Turla. Such partnerships could signify coordinated cyber espionage efforts to maximize operational impact across various sectors in Ukraine.