Ethical Hacking News
Russia-linked hackers, in collaboration with another threat actor, Sandworm, have carried out a destructive wiping attack targeting a Ukrainian logistics company. The attack utilized a previously undocumented backdoor called MythicRatatoskr, which communicated with a command-and-control (C2) server hosted inside the Yggdrasil mesh network. This attack highlights the growing trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure. ESET researchers noted that this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor, and it may signal a broader trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure.
The recent Ukraine-based attack by Russia-linked hackers, in collaboration with Sandworm, showcases the growing sophistication of state-sponsored cyber espionage campaigns. The attack involved UAC-0099 obtaining initial access to a Ukrainian logistics company through a spear-phishing email and deploying the MATCHWOK backdoor. The attack used a previously undocumented backdoor called MythicRatatoskr, which communicates with a command-and-control (C2) server hosted inside the Yggdrasil mesh network. The backdoor has features such as sending victim metadata to the C2 server, polling for new commands, and uploading/download files. The attack targeted government, energy, logistics, and grain sectors in Ukraine and is believed to be a collaboration between UAC-0099 and Sandworm. The use of a mesh network like Yggdrasil highlights the growing trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure. The MythicRatatoskr backdoor has a 10-minute startup delay, likely to avoid immediately connecting to the Yggdrasil network and evade detection. Source code references to "crond" within MythicRatatoskr suggest there possibly exists an equivalent Linux version of the malware.
The recent Ukraine-based attack carried out by Russia-linked hackers, in collaboration with another threat actor, Sandworm, showcases the growing sophistication of state-sponsored cyber espionage campaigns. According to ESET, the attack involved UAC-0099 obtaining initial access to a Ukrainian logistics company on July 16, 2025, through a spear-phishing email bearing a malware-laced attachment that led to the deployment of the MATCHWOK backdoor through a downloader called MATCHBOIL. The attack ultimately culminated with the threat actor handing off access to Sandworm, which then conducted a data-wiping attack on September 17, 2025.
The innovative use of a previously undocumented backdoor called MythicRatatoskr, which communicates with a command-and-control (C2) server hosted inside the Yggdrasil mesh network, sets this attack apart from others. Development on the backdoor is believed to have started sometime between December 2024 and February 2025. The backdoor's functionality is straightforward, with features such as sending victim metadata to the C2 server, polling for new commands, transmitting command output, taking screenshots, and uploading/download files. It also has the ability to alter the current working directory, enumerate directory contents, change the C2 server URL, execute a shell command via "cmd.exe," and spawn a reverse SOCKS5 proxy.
The deployment of MythicRatatoskr was found to have been done a day after MATCHWOK was executed. The attack's culminating event, which involved Sandworm carrying out a data-wiping attack by dropping the SDelete utility via Active Directory Group Policy, is also noteworthy. The attack targeted government, energy, logistics, and grain sectors in Ukraine, and it is believed that UAC-0099 was collaborating with Sandworm, as ESET had previously observed UAC-0099 conducting initial access operations and subsequently transferring "validated targets" to Sandworm for further post-exploitation.
This sort of cooperation between Russia-aligned actors is not new. Last year, ESET said it had identified evidence that Gamaredon and Turla were working together to target and co-compromise Ukrainian entities, with one intrusion leveraging Gamaredon's PteroGraphin to deploy Turla's Kazuar backdoor. Furthermore, a Gamaredon-linked downloader called Pterodo has been used to retrieve and execute InvisiMole, a modular spyware program put to use against targets in Ukraine and Russia.
The use of a mesh network like Yggdrasil, which hosts a C2 server for the backdoor, highlights the growing trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure. ESET researchers Anton Cherepanov and Peter Strýček noted that "to our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor, and it may signal a broader trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure."
The MythicRatatoskr backdoor has some artifacts, including a 10-minute startup delay, which is likely an effort to avoid immediately connecting to the Yggdrasil network and evade detection. The attack also involved the deployment of a SOCKS5 server to route connections through the compromised network.
While the attack investigated by ESET compromised a Windows system, source code references to "crond" within MythicRatatoskr suggest there possibly exists an equivalent Linux version of the malware. The assessment that UAC-0099 is likely collaborating with Sandworm is not new. In its APT Activity Report Q2 2025–Q3 2025, ESET said it observed UAC-0099 conducting initial access operations and subsequently transferring "validated targets" to Sandworm for further post-exploitation.
These attacks targeted government, energy, logistics, and grain sectors in Ukraine, and it is believed that UAC-0099 was collaborating with Sandworm, as ESET had previously observed UAC-0099 conducting initial access operations and subsequently transferring "validated targets" to Sandworm for further post-exploitation. The cooperation between Russia-aligned actors is also not new. Last year, ESET said it had identified evidence that Gamaredon and Turla were working together to target and co-compromise Ukrainian entities, with one intrusion leveraging Gamaredon's PteroGraphin to deploy Turla's Kazuar backdoor.
Furthermore, a Gamaredon-linked downloader called Pterodo has been used to retrieve and execute InvisiMole, a modular spyware program put to use against targets in Ukraine and Russia. The use of a mesh network like Yggdrasil, which hosts a C2 server for the backdoor, highlights the growing trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure.
The attack's use of MythicRatatoskr, a previously undocumented backdoor, sets this attack apart from others. The backdoor's functionality is straightforward, with features such as sending victim metadata to the C2 server, polling for new commands, transmitting command output, taking screenshots, and uploading/download files. It also has the ability to alter the current working directory, enumerate directory contents, change the C2 server URL, execute a shell command via "cmd.exe," and spawn a reverse SOCKS5 proxy.
The deployment of MythicRatatoskr was found to have been done a day after MATCHWOK was executed. The attack's culminating event, which involved Sandworm carrying out a data-wiping attack by dropping the SDelete utility via Active Directory Group Policy, is also noteworthy. The attack targeted government, energy, logistics, and grain sectors in Ukraine, and it is believed that UAC-0099 was collaborating with Sandworm, as ESET had previously observed UAC-0099 conducting initial access operations and subsequently transferring "validated targets" to Sandworm for further post-exploitation.
The use of a mesh network like Yggdrasil, which hosts a C2 server for the backdoor, highlights the growing trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure. ESET researchers Anton Cherepanov and Peter Strýček noted that "to our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor, and it may signal a broader trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure."
The MythicRatatoskr backdoor has some artifacts, including a 10-minute startup delay, which is likely an effort to avoid immediately connecting to the Yggdrasil network and evade detection. The attack also involved the deployment of a SOCKS5 server to route connections through the compromised network.
While the attack investigated by ESET compromised a Windows system, source code references to "crond" within MythicRatatoskr suggest there possibly exists an equivalent Linux version of the malware. The assessment that UAC-0099 is likely collaborating with Sandworm is not new. In its APT Activity Report Q2 2025–Q3 2025, ESET said it observed UAC-0099 conducting initial access operations and subsequently transferring "validated targets" to Sandworm for further post-exploitation.
These attacks targeted government, energy, logistics, and grain sectors in Ukraine, and it is believed that UAC-0099 was collaborating with Sandworm, as ESET had previously observed UAC-0099 conducting initial access operations and subsequently transferring "validated targets" to Sandworm for further post-exploitation. The cooperation between Russia-aligned actors is also not new. Last year, ESET said it had identified evidence that Gamaredon and Turla were working together to target and co-compromise Ukrainian entities, with one intrusion leveraging Gamaredon's PteroGraphin to deploy Turla's Kazuar backdoor.
Furthermore, a Gamaredon-linked downloader called Pterodo has been used to retrieve and execute InvisiMole, a modular spyware program put to use against targets in Ukraine and Russia. The use of a mesh network like Yggdrasil, which hosts a C2 server for the backdoor, highlights the growing trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure.
The attack's use of MythicRatatoskr, a previously undocumented backdoor, sets this attack apart from others. The backdoor's functionality is straightforward, with features such as sending victim metadata to the C2 server, polling for new commands, transmitting command output, taking screenshots, and uploading/download files. It also has the ability to alter the current working directory, enumerate directory contents, change the C2 server URL, execute a shell command via "cmd.exe," and spawn a reverse SOCKS5 proxy.
The deployment of MythicRatatoskr was found to have been done a day after MATCHWOK was executed. The attack's culminating event, which involved Sandworm carrying out a data-wiping attack by dropping the SDelete utility via Active Directory Group Policy, is also noteworthy. The attack targeted government, energy, logistics, and grain sectors in Ukraine, and it is believed that UAC-0099 was collaborating with Sandworm, as ESET had previously observed UAC-0099 conducting initial access operations and subsequently transferring "validated targets" to Sandworm for further post-exploitation.
The use of a mesh network like Yggdrasil, which hosts a C2 server for the backdoor, highlights the growing trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure. ESET researchers Anton Cherepanov and Peter Strýček noted that "to our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor, and it may signal a broader trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure."
The MythicRatatoskr backdoor has some artifacts, including a 10-minute startup delay, which is likely an effort to avoid immediately connecting to the Yggdrasil network and evade detection. The attack also involved the deployment of a SOCKS5 server to route connections through the compromised network.
While the attack investigated by ESET compromised a Windows system, source code references to "crond" within MythicRatatoskr suggest there possibly exists an equivalent Linux version of the malware. The assessment that UAC-0099 is likely collaborating with Sandworm is not new. In its APT Activity Report Q2 2025–Q3 2025, ESET said it observed UAC-0099 conducting initial access operations and subsequently transferring "validated targets" to Sandworm for further post-exploitation.
These attacks targeted government, energy, logistics, and grain sectors in Ukraine, and it is believed that UAC-0099 was collaborating with Sandworm, as ESET had previously observed UAC-0099 conducting initial access operations and subsequently transferring "validated targets" to Sandworm for further post-exploitation. The cooperation between Russia-aligned actors is also not new. Last year, ESET said it had identified evidence that Gamaredon and Turla were working together to target and co-compromise Ukrainian entities, with one intrusion leveraging Gamaredon's PteroGraphin to deploy Turla's Kazuar backdoor.
Furthermore, a Gamaredon-linked downloader called Pterodo has been used to retrieve and execute InvisiMole, a modular spyware program put to use against targets in Ukraine and Russia. The use of a mesh network like Yggdrasil, which hosts a C2 server for the backdoor, highlights the growing trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure.
The MythicRatatoskr backdoor has some artifacts, including a 10-minute startup delay, which is likely an effort to avoid immediately connecting to the Yggdrasil network and evade detection. The attack also involved the deployment of a SOCKS5 server to route connections through the compromised network.
While the attack investigated by ESET compromised a Windows system, source code references to "crond" within MythicRatatoskr suggest there possibly exists an equivalent Linux version of the malware. The assessment that UAC-0099 is likely collaborating with Sandworm is not new. In its APT Activity Report Q2 2025–Q3 2025, ESET said it observed UAC-0099 conducting initial access operations and subsequently transferring "validated targets" to Sandworm for further post-exploitation.
These attacks targeted government, energy, logistics, and grain sectors in Ukraine, and it is believed that UAC-0099 was collaborating with Sandworm, as ESET had previously observed UAC-0099 conducting initial access operations and subsequently transferring "validated targets" to Sandworm for further post-exploitation. The cooperation between Russia-aligned actors is also not new. Last year, ESET said it had identified evidence that Gamaredon and Turla were working together to target and co-compromise Ukrainian entities, with one intrusion leveraging Gamaredon's PteroGraphin to deploy Turla's Kazuar backdoor.
Furthermore, a Gamaredon-linked downloader called Pterodo has been used to retrieve and execute InvisiMole, a modular spyware program put to use against targets in Ukraine and Russia. The use of a mesh network like Yggdrasil, which hosts a C2 server for the backdoor, highlights the growing trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure.
Related Information:
https://www.ethicalhackingnews.com/articles/Russia-Linked-Hackers-Unveil-Experimental-Peer-to-Peer-Network-Backdoor-in-Destructive-Ukraine-Attack-ehn.shtml
https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html
Published: Fri Oct 23 14:14:13 2026 by llama3.2 3B Q4_K_M
