UAC-0099 and Sandworm collaboration: MythicRatatoskr backdoor and destructive wiping

ESET research identified a collaboration between UAC-0099 and Sandworm targeting a Ukrainian grain logistics firm. UAC-0099 provided initial access via spearphishing and the MATCHWOK backdoor, subsequently deploying the novel Go-based 'MythicRatatoskr' backdoor. This backdoor leverages the Yggdrasil decentralized mesh network for C2 communications, providing robust, non-centralized connectivity. After lateral movement and the deployment of proxy tools, Sandworm executed a destructive data-wiping attack using SDelete via Active Directory Group Policy.

Attack Chain

1. Initial Access: UAC-0099 delivered a malicious attachment via spearphishing email (July 16, 2025).
2. Execution: A scheduled task 'pdfopentask' executed a PowerShell payload from %temp%.
3. Downloader: Deployment of the MATCHBOIL downloader to fetch and execute the MATCHWOK backdoor.
4. Backdoor Deployment: Delivery of the MythicRatatoskr backdoor, which persists as a Windows service.
5. Lateral Movement: Additional MythicRatatoskr samples deployed to other hosts via OpenSSH SFTP.
6. Proxy Deployment: Deployment of a SOCKS5 server via MythicRatatoskr to facilitate internal pivoting.
7. Impact: Sandworm deployed SDelete via Active Directory Group Policy to perform data wiping (September 17, 2025).

Impact

The campaign resulted in the compromise of multiple internal systems and culminated in destructive data-wiping operations against the target organization, leading to significant operational disruption.

Recommendation

• Deploy detection for atypical Windows services, particularly those running Go-compiled binaries that exhibit Yggdrasil mesh networking characteristics.
• Monitor for the creation of scheduled tasks named 'pdfopentask' and unauthorized PowerShell execution from temporary directories.
• Audit Active Directory Group Policy objects for the unauthorized distribution of utility tools such as SDelete.
• Hunt for outbound traffic over non-standard ports or encrypted overlay networks (specifically Yggdrasil-related IPv6 traffic) originating from internal assets.