ESET researchers have published an investigation of a destructive attack on a Ukrainian logistics company in which two Russia-aligned groups appear to have worked in sequence. According to ESET, as reported by The Hacker News, UAC-0099 (also tracked as Earth Sirrush) got in on July 16, 2025 with a spear-phishing email carrying a malicious attachment. That led to the MATCHBOIL downloader and the MATCHWOK backdoor. Access was then handed to Sandworm, the Russian state-sponsored group, which ran a data-wiping attack on September 17, 2025, more than two months after the first foothold.
What makes the case unusual is a previously undocumented backdoor, MythicRatatoskr, deployed a day after MATCHWOK ran. It sends victim details to its command-and-control server, polls for commands, takes screenshots, moves files and can start a reverse SOCKS5 proxy. The server was hosted inside the Yggdrasil mesh network, a peer-to-peer overlay network, which ESET says made it particularly hard to work out where the server physically was. The backdoor waited ten minutes after starting before joining Yggdrasil, which may be an attempt to avoid early detection. ESET believes it was probably used to deploy the SOCKS5 server that routed connections through the victim’s network. Sandworm then wiped data by pushing the SDelete utility through Active Directory Group Policy, a technique ESET describes as consistent with Sandworm’s earlier destructive operations. ESET could not say whether UAC-0099 or Sandworm built MythicRatatoskr, and source-code references to “crond” suggest a Linux version may exist.
ESET calls this, to its knowledge, the first documented abuse of Yggdrasil by a state-aligned actor and says it may signal a broader move toward experimental peer-to-peer networks for attacker infrastructure. The researchers also point to earlier signs of cooperation: its Q2-Q3 2025 report described UAC-0099 transferring “validated targets” to Sandworm, and The Hacker News notes ESET previously saw Gamaredon and Turla working together. Indicators of compromise and samples are published in ESET’s GitHub repository, linked from the research post.