A Russia-aligned espionage crew broke into a Ukrainian grain logistics company with a booby-trapped email, quietly held the door open for two months, and then handed the keys to Sandworm, the GRU unit best known for destructive attacks on Ukraine. On September 17, 2025, Sandworm used that access to wipe the company's data.
That is the sequence reconstructed by researchers at ESET in their original report, which also documents a previously unknown backdoor, MythicRatatoskr, that hid its command server inside the Yggdrasil mesh network rather than on the ordinary internet. ESET presented the findings at LABScon on September 18, 2026, and at the Virus Bulletin conference on October 16, 2026.
One group opens the door, another burns the house
According to ESET telemetry, the intrusion began on July 16, 2025, when a scheduled task named pdfopentask ran a PowerShell payload on one machine. A minute later the MATCHBOIL downloader arrived and installed the MATCHWOK backdoor, both tools already tied to UAC-0099, a group that targets Ukrainian government, finance and media organizations. IntelFusions covered how that downloader keeps evolving earlier this month.
The next morning, MythicRatatoskr landed on the same machine. More copies were later pushed to other hosts through an OpenSSH SFTP server, followed by a SOCKS5 proxy that ESET believes the backdoor delivered. About two months later, data-wiping began, carried out by deploying the SDelete utility through Active Directory Group Policy. ESET calls that standard Sandworm tradecraft.
ESET attributes the first stage to UAC-0099 and the wiping to Sandworm, both with high confidence, and assesses with high confidence that UAC-0099 handed over access at some point. What it cannot yet say is which of the two groups was actually operating MythicRatatoskr. ESET notes that such handoffs between Russia-aligned actors are no longer surprising, citing its earlier finding that Gamaredon worked alongside Turla.
A squirrel that talks through a world tree
MythicRatatoskr is written in Go and named after the squirrel of Norse mythology that carries messages up and down Yggdrasil, the world tree. The real Yggdrasil is a decentralized, experimental mesh network that builds an encrypted IPv6 overlay on top of the internet, with no central server. ESET stresses that it is not designed for anonymity, but hosting the command server inside the mesh may stop network security tools from detecting outbound connections to it.
The malware is built on the open-source yggstack project, so it needs no special network interface or admin rights to join the mesh. It carries a base64-encoded list of 32 public peers, picks three at random, joins the public network, and then talks to its command server over HTTPS on port 443. It generates a fresh key pair on each run, so the victim machine's mesh address changes every time.
Its commands cover the usual backdoor kit: running commands, browsing and transferring files, taking screenshots of every display, exposing local ports to the mesh, and running a reverse SOCKS5 proxy. Some samples wait 10 minutes after launch before connecting, which ESET says is likely meant to evade detection. Configuration paths such as .crond with forward slashes suggest a Linux variant may also exist, although ESET's evidence for it is indirect.
Block the public peers to cut the line
ESET's key defensive point is that although the command server lives inside Yggdrasil, the malware still has to reach public peers on the open internet to get there, so blocking those peer addresses is a viable mitigation. Defenders should also look for a Windows service named ieupdate, encrypted config files named .updatecache under C:\Windows\Temp or C:\Windows\system32, and executables such as krbtman.exe, updater.exe and WindowsDefenderSvc.exe in system32. ESET's report carries the full list of 32 peers to block.
Indicators of compromise
- MythicRatatoskr C&C (Yggdrasil): 201:b479:2771:8df4:b5eb:d007:63b0[:]2838 (HTTPS 443, proxy on 8080)
- MATCHWOK C&C: hxxps://uztickets[.]com
- MATCHBOIL download URL: hxxps://egyptanimals[.]com/animals/photoalbum
- Service name: ieupdate; scheduled task: pdfopentask
The lesson goes beyond one exotic backdoor. An espionage foothold in a Ukrainian food-supply business turned out to be a staging post for sabotage, which means an intrusion that looks like quiet spying should be treated as a possible prelude to destruction.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.