{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/yggdrasil/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["Sandworm","BlackEnergy","Voodoo Bear","Seashell Blizzard","IRIDIUM"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["critical"],"_cs_tags":["backdoor","wiper","uac-0099","sandworm","yggdrasil"],"_cs_type":"threat","_cs_vendors":[],"content_html":"\u003cp\u003eESET research identified a collaboration between UAC-0099 and Sandworm targeting a Ukrainian grain logistics firm. UAC-0099 provided initial access via spearphishing and the MATCHWOK backdoor, subsequently deploying the novel Go-based 'MythicRatatoskr' backdoor. This backdoor leverages the Yggdrasil decentralized mesh network for C2 communications, providing robust, non-centralized connectivity. After lateral movement and the deployment of proxy tools, Sandworm executed a destructive data-wiping attack using SDelete via Active Directory Group Policy.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial Access: UAC-0099 delivered a malicious attachment via spearphishing email (July 16, 2025).\u003c/li\u003e\n\u003cli\u003eExecution: A scheduled task 'pdfopentask' executed a PowerShell payload from %temp%.\u003c/li\u003e\n\u003cli\u003eDownloader: Deployment of the MATCHBOIL downloader to fetch and execute the MATCHWOK backdoor.\u003c/li\u003e\n\u003cli\u003eBackdoor Deployment: Delivery of the MythicRatatoskr backdoor, which persists as a Windows service.\u003c/li\u003e\n\u003cli\u003eLateral Movement: Additional MythicRatatoskr samples deployed to other hosts via OpenSSH SFTP.\u003c/li\u003e\n\u003cli\u003eProxy Deployment: Deployment of a SOCKS5 server via MythicRatatoskr to facilitate internal pivoting.\u003c/li\u003e\n\u003cli\u003eImpact: Sandworm deployed SDelete via Active Directory Group Policy to perform data wiping (September 17, 2025).\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe campaign resulted in the compromise of multiple internal systems and culminated in destructive data-wiping operations against the target organization, leading to significant operational disruption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy detection for atypical Windows services, particularly those running Go-compiled binaries that exhibit Yggdrasil mesh networking characteristics.\u003c/li\u003e\n\u003cli\u003eMonitor for the creation of scheduled tasks named 'pdfopentask' and unauthorized PowerShell execution from temporary directories.\u003c/li\u003e\n\u003cli\u003eAudit Active Directory Group Policy objects for the unauthorized distribution of utility tools such as SDelete.\u003c/li\u003e\n\u003cli\u003eHunt for outbound traffic over non-standard ports or encrypted overlay networks (specifically Yggdrasil-related IPv6 traffic) originating from internal assets.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T08:57:26Z","date_published":"2026-10-23T08:57:26Z","id":"https://feed.craftedsignal.io/briefs/2026-10-mythicratatoskr-uac0099/","summary":"UAC-0099 gained initial access to a Ukrainian organization via spearphishing to deploy the MythicRatatoskr backdoor, which uses the Yggdrasil mesh network for C2, before handing off access to Sandworm for destructive data-wiping.","title":"UAC-0099 and Sandworm collaboration: MythicRatatoskr backdoor and destructive wiping","url":"https://feed.craftedsignal.io/briefs/2026-10-mythicratatoskr-uac0099/"}],"language":"en","title":"CraftedSignal Threat Feed - Yggdrasil","version":"https://jsonfeed.org/version/1.1"}