Sandworm and UAC-0099 Hit Ukraine With a Backdoor Hidden in the Yggdrasil Mesh Network

ESET researchers have detailed a targeted attack on a Ukrainian logistics company in which two Russia-linked groups worked hand in hand. Initial access was obtained on July 16, 2025 by UAC-0099 (also tracked as Earth Sirrush): the victim opened a malware-laced attachment from a spear-phishing email, leading to the deployment of the MATCHWOK backdoor via a downloader called MATCHBOIL.

More than two months later, on September 17, 2025, access was handed off to Sandworm, which carried out a destructive data-wiping attack. It relied on the legitimate SDelete utility, dropped through Active Directory Group Policy. ESET notes that Sandworm's known NikoWiper malware is likewise derived from SDelete.

Command and control over a mesh network

The standout feature of the operation is a previously undocumented backdoor called MythicRatatoskr, which UAC-0099 deployed a day after running MATCHWOK. It talked to a command-and-control server hosted inside the Yggdrasil peer-to-peer mesh network. According to ESET, this is the first documented case of a state-aligned actor abusing Yggdrasil in this way, and it may signal a broader trend of adversaries adopting experimental peer-to-peer networks to make their infrastructure more resilient and stealthy.

The backdoor's capabilities are fairly conventional: it sends victim metadata, polls for commands, returns their output, takes screenshots, uploads and downloads files, changes the working directory, lists directory contents, swaps the C2 URL, runs shell commands via cmd.exe, and spawns a reverse SOCKS5 proxy. Some samples include a ten-minute startup delay, likely to avoid connecting to Yggdrasil immediately and to evade detection. Development appears to have begun between December 2024 and February 2025.

The case ESET investigated involved a Windows system, but a reference to "crond" in the MythicRatatoskr source code hints at a possible Linux variant.

Not a one-off partnership

The assessment that UAC-0099 cooperates with Sandworm is not new: in its Q2–Q3 2025 report, ESET had already observed UAC-0099 performing initial access and then passing "validated targets" to Sandworm for follow-on activity. The campaigns hit government, energy, logistics, and grain sectors in Ukraine.

Such collaboration is a recurring pattern among Russia-aligned groups. ESET previously documented joint operations by Gamaredon and Turla, one of which used the PteroGraphin loader to deliver the Kazuar backdoor. The company assesses that this kind of coordination is meant to amplify the overall impact of their cyber-espionage campaigns.

Source: The Hacker News