• ESET researchers discovered that a previously unknown backdoor, MythicRatatoskr, was deployed in an intrusion that later culminated in a destructive attack against a Ukrainian grain firm.
  • Russia-aligned UAC-0099 gained initial access and handed it off to Sandworm. Sandworm is attributed to GRU Unit 74455.
  • The execution chain relied on known malware already attributed to UAC-0099 — namely the MATCHBOIL downloader and the MATCHWOK backdoor.

BRATISLAVA, Slovakia, Oct. 22, 2026 (GLOBE NEWSWIRE) — ESET researchers discovered MythicRatatoskr — a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network — that paved the way for a destructive attack against a Ukrainian grain firm. Russia-aligned APT group UAC-0099 gained initial access and handed it off to another Russia-aligned group, Sandworm, which then conducted a data-wiping attack.

The handover documented in the released report is not an isolated phenomenon: Earlier in 2025, ESET Research uncovered that Russia-aligned Gamaredon collaborated with Turla, another Russia-aligned threat actor. Sandworm is attributed to GRU Unit 74455, and in conjunction with known targeting, ESET assesses that UAC-0099 is also aligned with Russian interests. Furthermore, ESET assesses that UAC-0099 can act as an initial access group for Sandworm.

“On July 16, 2025, UAC-0099 gained initial access to a grain logistics company in Ukraine via a spear phishing email with a malicious attachment, leading to the execution chain of the MATCHWOK backdoor. One day later, the attackers deployed MythicRatatoskr, which communicates with a command and control server hosted inside the Yggdrasil mesh network. We have not seen the backdoor used anywhere else, and we found indications that a Linux variant may also exist,” says ESET researcher Anton Cherepanov, who investigated the attack.

Yggdrasil is a decentralized mesh network that implements an experimental routing scheme in which the IPv6 communication between the nodes is end-to-end protected. “The word ‘Yggdrasil’ originates in Norse mythology, where it refers to a sacred tree connecting the different realms of the cosmos. Within that tree lives a squirrel named Ratatoskr that carries messages between the tree’s top and its roots. Given the backdoor’s role as a messenger scurrying through the Yggdrasil network, we decided to name the backdoor MythicRatatoskr,” explains ESET researcher Peter Strýček, who co-discovered MythicRatatoskr along with Cherepanov.

The post-compromise execution chain relied on known malware already attributed to UAC-0099 — namely the MATCHBOIL downloader and the MATCHWOK backdoor — leading ESET to attribute this stage of the attack to UAC-0099 with high confidence. ESET researchers attribute the data-wiping activity observed two months later to Sandworm (also with high confidence, based on the TTPs involved). According to ESET telemetry, the initial access gained by UAC-0099 was later used in an activity that culminated in the destructive Sandworm operation.

MythicRatatoskr supports standard backdoor functionality, including command execution, filesystem navigation, file transfer, screenshot capture, and proxying. The backdoor was probably used to deploy a SOCKS5 server to route connections through the compromised network.

UAC-0099 is a cyberespionage group targeting governmental organizations, financial institutions, and media, all in Ukraine. Based on the targeting, ESET believes with medium confidence that the group is aligned with Russian interests. Sandworm is a Russia-aligned threat group that performs destructive attacks.

ESET Research presented its findings about MythicRatatoskr at LABScon on September 18, 2026, and at the Virus Bulletin conference on October 16, 2026.

For more technical details, check out the ESET Research blogpost “MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC 0099-Sandworm collaboration” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.

Yggdrasil map with the C&C server (October 11, 2025)

image1.png

About ESET®
ESET protects organizations, critical infrastructure, and individuals, helping them build digital resilience and confidence in an increasingly AI-driven world. With more than 35 years of cybersecurity expertise, over 25 years of AI innovation, and 11 global R&D centers, ESET develops proprietary technologies designed to protect against evolving cyber threats and secure the broader AI ecosystem. Grounded in scientific rigor and taking a preemptive approach to security, ESET delivers effortless protection that remains under expert human oversight. Headquartered in the European Union and privately owned, ESET protects millions of users and more than 500,000 organizations across 178 countries. Committed to responsible AI and customer trust, ESET protects the progress that technology enables. For more information, visit www.eset.com, or follow ESET’s social media, podcasts, and blogs.

A photo accompanying this announcement is available at:
https://www.globenewswire.com/NewsRoom/AttachmentNg/87292ee6-5b5c-4746-aa94-296335db0b43


Media contact:
Jessica Beffa
jessica.beffa@eset.com
720-413-4938

Primary Logo

About The Author
ESET