Sandworm Wiper Attack in Ukraine Used MythicRatatoskr, a New Backdoor With C2 Inside the Yggdrasil Mesh Network

A Russian state-aligned intrusion into a Ukrainian logistics company ended with data wiped across the domain. The attackers had held access for 63 days before the wipe. ESET researchers Anton Cherepanov and Peter Strýček attribute the operation to two groups working in sequence. UAC-0099, also tracked as Earth Sirrush, got in, kept access and checked the target. Sandworm then ran the destructive phase. The most technically significant finding is a previously undocumented backdoor, MythicRatatoskr, whose command-and-control server sits inside the Yggdrasil mesh network. ESET says this is the first documented case of a state-aligned actor abusing Yggdrasil this way.

The Intrusion Timeline

The attack ran through four stages that ESET was able to date:

• July 16, 2025: UAC-0099 gains initial access with a spear-phishing email carrying a malicious attachment. The attachment runs the MATCHBOIL downloader, which installs the MATCHWOK backdoor.
• July 17, 2025: One day after MATCHWOK runs, UAC-0099 deploys MythicRatatoskr, a second backdoor that talks to its operators over Yggdrasil.
• Between those dates and mid-September: MythicRatatoskr deploys a SOCKS5 server to route attacker connections through the compromised network, and UAC-0099 hands access to Sandworm.
• September 17, 2025: Sandworm wipes data by distributing the Sysinternals SDelete utility through Active Directory Group Policy.

The two-backdoor setup matters. MATCHWOK was the first foothold. MythicRatatoskr gave a second, separate channel over infrastructure that conventional blocking struggles with. If defenders had found and removed MATCHWOK, the operators would still have had a way back in.

Why Yggdrasil Changes the C2 Picture

Yggdrasil is an experimental, end-to-end encrypted IPv6 overlay network. Nodes find each other through peering, and each node's address is derived from its cryptographic keys, not from an internet provider's allocation. To a defender, that removes most of the usual leverage against C2 servers. There is no domain to sinkhole, no registrar to contact and no hosting provider to send a takedown request to. The traffic that leaves the victim network goes to a Yggdrasil peer, not to the operator's server directly.

Some MythicRatatoskr samples wait 10 minutes after startup before connecting to Yggdrasil. ESET reads this as an attempt to avoid detection. Sandboxes often stop observing a sample after a few minutes, and a network connection made right after a new process starts on an endpoint is an easy behavioral signal to catch.

MythicRatatoskr Capabilities

ESET's analysis suggests development started sometime between December 2024 and February 2025. The feature set is simple but covers what operators need for hands-on-keyboard work and for moving traffic through a victim network:

• Sends victim metadata to the C2 and polls for new commands
• Returns command output, takes screenshots, uploads and downloads files
• Changes the working directory and lists directory contents
• Changes the C2 server URL at runtime
• Runs shell commands through cmd.exe
• Starts a reverse SOCKS5 proxy, which in this case turned the infected host into a relay into the internal network

The sample ESET investigated ran on Windows. However, the source code contains references to "crond", which suggests a Linux version may exist. ESET has not confirmed one. Linux servers and appliances should be treated as possible targets until the question is settled.

The Wipe: Built From Admin Tools

Sandworm did not need custom destructive code for the final stage. It pushed SDelete, a legitimate Microsoft Sysinternals tool for secure file deletion, to machines through Active Directory Group Policy. With domain-level control, a single GPO can reach every domain-joined machine at its next policy refresh. That is why the effect was so wide. ESET also notes that NikoWiper, a wiper previously linked to Sandworm, is itself based on SDelete, so this is a known pattern for the group and not a one-off.

Access Brokering Between Russian Groups

The handoff from UAC-0099 to Sandworm fits a pattern ESET has already reported. Its APT Activity Report covering Q2 2025 to Q3 2025 described UAC-0099 carrying out initial access operations and passing "validated targets" to Sandworm for post-exploitation. Those targets were in Ukraine's government, energy, logistics and grain sectors.

Other Russia-aligned groups have worked together in the same way. ESET has documented Gamaredon and Turla compromising the same Ukrainian entities, including one intrusion in which Gamaredon's PteroGraphin was used to deploy Turla's Kazuar backdoor. Separately, Gamaredon's Pterodo downloader has been seen retrieving and running InvisiMole, a modular spyware tool used against targets in Ukraine and Russia.

For defenders, this division of labor changes how alerts should be prioritized. A UAC-0099 phishing foothold that looks like low-grade espionage may be the first stage of a destructive operation run by a different team weeks later. In this case the gap was more than two months. The detection window is there, but only if an early-stage alert is treated as a possible precursor to a wipe and not closed as routine.

RedEye Assessment

Three points matter beyond Ukraine. First, overlay networks like Yggdrasil are now confirmed as C2 transport for a state-aligned actor, and ESET explicitly flags a possible wider trend. Network monitoring built around domains, IP reputation and takedowns gives little visibility into this traffic. Second, the destructive stage used Group Policy and a signed Microsoft utility, so control of Active Directory was enough to carry out the wipe. Third, the 63-day gap between access and impact shows that access brokering between Russian groups is a working production model, not a theory. Organizations in logistics, energy, agriculture or government that support Ukraine, or that operate in the region, should assume they are in scope. RedEye's threat hunting and Active Directory assessments are built to find this kind of staged, low-noise access before it is handed to a destructive actor.