Skip to content
Hacker Posts

MythicRatatoskr: Sandworm backdoor uses Yggdrasil mesh for C2

ESET details MythicRatatoskr, a novel backdoor whose C2 rode the Yggdrasil mesh network in a July–Sept 2025 wiper attack on a Ukrainian logistics firm, tying UAC-0099 access to Sandworm.

Published 3 min read
researchsandwormuac-0099russia

ESET has published research on MythicRatatoskr, a previously undocumented backdoor it says routed command-and-control traffic through the Yggdrasil mesh network during a destructive attack on a Ukrainian grain-logistics company. ESET calls this the first documented case of a state-aligned actor abusing Yggdrasil this way. The Hacker News covered the report on October 23. If you defend Ukrainian or allied logistics, energy or government networks, this is a hunt item, not just reading.

Who and what

ESET attributes initial access to UAC-0099 (which it also tracks as Earth Sirrush) and assesses the group is "likely collaborating" with Sandworm, the Russia-aligned actor behind a long run of destructive operations against Ukraine. The hedge matters: this is ESET's assessment of a collaboration, not a court-established fact. ESET says it investigated more than ten destructive Sandworm incidents in 2025, most in Ukraine.

The chain

Per ESET's timeline:

  • July 16, 2025 — initial access via a spear-phishing email carrying a malicious attachment.
  • Shortly after — the MATCHWOK backdoor, delivered through the MATCHBOIL downloader. MythicRatatoskr was deployed a day after MATCHWOK ran.
  • September 17, 2025 — the wiping step, using the legitimate SDelete utility pushed via Active Directory Group Policy. ESET notes Sandworm's NikoWiper malware is derived from SDelete.

What MythicRatatoskr does

It sends victim metadata to its C2 and polls for commands, returns command output, takes screenshots, uploads and downloads files, enumerates directories, changes its working directory, rewrites its own C2 URL, runs shell commands through cmd.exe, and can spawn a reverse SOCKS5 proxy. Some samples carry a 10-minute startup delay ESET reads as anti-detection. The C2 lives inside Yggdrasil — a decentralized mesh with end-to-end encrypted IPv6 routing between nodes — which hides the controller behind peer relaying rather than a reachable public host. ESET believes development began between December 2024 and February 2025, and says it has not seen the backdoor since this case. A Linux build "possibly exists," on the strength of crond references in the code — unconfirmed.

Action checklist

  1. Pull the IOCs from ESET's report and load the hashes, file paths and network indicators into your EDR and NSM. We are not reproducing them here unverified.
  2. Hunt for Yggdrasil. Flag the Yggdrasil client/daemon, its default peering ports and 0200::/7 IPv6 traffic on hosts that have no business running a mesh overlay.
  3. Audit SDelete via GPO. Alert on sdelete/sdelete64 arriving through Group Policy or scheduled tasks on servers — a classic Sandworm wiping pattern.
  4. Review spear-phishing controls for attachment-borne loaders, and check for MATCHBOIL/MATCHWOK artifacts if you run exposed, Ukraine-facing infrastructure.

Context

The novelty here is the transport, not the toolkit: a backdoor that hides its controller inside a peer-to-peer mesh is harder to sinkhole or block at the perimeter than one calling a fixed domain. It fits Sandworm's 2025 tempo of destructive operations — the same unit the EU and UK named in their first joint cyber sanctions this summer — and the UAC-0099-to-Sandworm handoff is the detail worth watching: access brokers feeding a destructive operator shortens the path from phish to wipe.

Related stories