ESET details MythicRatatoskr backdoor in UAC-0099 and Sandworm operation
Summary
ESET describes a Ukrainian intrusion in which UAC-0099 deployed the Yggdrasil-enabled MythicRatatoskr backdoor before access was handed to Sandworm, which later wiped data using SDelete.
Key points
- ESET says UAC-0099 gained access to a Ukrainian grain logistics company through spearphishing on July 16, 2025, deploying MATCHBOIL and MATCHWOK.
- MythicRatatoskr, a previously undocumented Go backdoor, appeared the next day and used the Yggdrasil mesh network to reach its HTTPS command-and-control server.
- The backdoor supports shell commands, file transfers, screenshots, and proxying; it also sends user, host, and local network details to its operator.
- ESET assesses with high confidence that UAC-0099 handed access to Sandworm, but says it cannot determine which group primarily operated MythicRatatoskr.
- On September 17, 2025, Sandworm carried out a data-wiping attack using SDelete deployed through Active Directory Group Policy.
- ESET found a separate SOCKS5 server and believes MythicRatatoskr was probably used to deploy it; evidence also suggests, but does not confirm, a Linux variant.
Article Details
- Attack Vectors
- UAC-0099 gained initial access to a Ukrainian grain logistics company through a spearphishing email with a malicious attachment.
- The MATCHBOIL downloader deployed the MATCHWOK backdoor; MythicRatatoskr was deployed the following day, with ESET assessing that the MATCHWOK execution chain led to its deployment.
- MythicRatatoskr communicated with its C&C server over the Yggdrasil mesh network and could transfer files and screenshots through that channel.
- ESET assessed that UAC-0099 handed access to Sandworm, which later deployed SDelete via Active Directory Group Policy to wipe data.
- Defensive Notes
- The report identifies blocking public Yggdrasil peer addresses as a viable mitigation for disrupting MythicRatatoskr's access to the mesh network.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA1 | 01855153ca7a33ad5ff36451de5612dfba0dd2ca | SHA-1 of a krbtman.exe sample identified as the MythicRatatoskr backdoor. |
| SHA1 | 028ca11f3f0d8396043af7bf756231fc2f50f829 | SHA-1 of a windowsdefendersvc.exe sample identified as the MythicRatatoskr backdoor. |
| SHA1 | 09c816697c0c2aff9b4ff58681558ca30d04c9cd | SHA-1 of an nbtresolver.exe sample identified as the standalone SOCKS5 server. |
| SHA1 | 131a371a1e4ee78ec3b2863607c99290ec3b58a6 | SHA-1 of a krbtman.exe sample identified as the standalone SOCKS5 server. |
| SHA1 | 4e3e6577866e4ce2ed73ca089700ae04230e768f | SHA-1 of an ieupdate.exe sample identified as the MythicRatatoskr backdoor. |
| SHA1 | 69969eeb7e0a3d84c4e70193636fcf934c6aa388 | SHA-1 of an ieupdate.exe sample identified as the MythicRatatoskr backdoor. |
| SHA1 | 8ceb5f8bcdf4995b7164996f1629d682613bb17b | SHA-1 of an ieupdate.exe sample identified as the MythicRatatoskr backdoor. |
| SHA1 | 9085896989947c0919a660352f75f6b233fc645b | SHA-1 of a windowsdefendersvc.exe sample identified as the MythicRatatoskr backdoor. |
| SHA1 | b69ef0e45b401440c0fde22046775d0c57e87415 | SHA-1 of an ie.exe sample identified as the MythicRatatoskr backdoor. |
| SHA1 | d5f9288daebf87ae4579945f8dc6cf235b093cfd | SHA-1 of an Act64.exe sample identified as the MythicRatatoskr backdoor. |
| SHA1 | d7e6a5a46c6ed3510997e91b11e51be0250fd2a2 | SHA-1 of an updater.exe sample identified as the MythicRatatoskr backdoor. |
| SHA1 | e29af83a07fb32eb47c28733a9382e766d53f704 | SHA-1 of a OneDriveLiveUpdater.exe sample identified as the MythicRatatoskr backdoor. |
| URL | hxxps[:]//egyptanimals[.]com/animals/photoalbum | Payload-delivery URL from which MATCHBOIL downloaded MATCHWOK. |
| URL | hxxps[:]//uztickets[.]com | C&C address identified for the MATCHWOK backdoor. |
MITRE ATT&CK
T1005 · Data from Local SystemOperators can use MythicRatatoskr's ls command to locate files on the compromised system.T1027.013 · Encrypted/Encoded FileThe MythicRatatoskr configuration file is encrypted using AES-256-CFB.T1041 · Exfiltration Over C2 ChannelMythicRatatoskr can send files to its C&C server over the Yggdrasil-routed channel.T1059.003 · Windows Command ShellMythicRatatoskr can execute shell commands through cmd.exe.T1071.001 · Web ProtocolsMythicRatatoskr communicates with its C&C server using HTTPS over Yggdrasil.T1090.001 · Internal ProxyA separately deployed SOCKS5 server was used to proxy connections within the target network.T1090.003 · Multi-hop ProxyMythicRatatoskr reaches its C&C server through the Yggdrasil mesh network.T1105 · Ingress Tool TransferESET assesses that the SOCKS5 server was probably delivered using MythicRatatoskr.T1113 · Screen CaptureMythicRatatoskr has a command to capture screenshots of active displays.T1132.001 · Standard EncodingMythicRatatoskr returns command results encoded with base64 when present.T1485 · Data DestructionSandworm carried out a data-wiping attack using SDelete.T1543.003 · Windows ServiceMythicRatatoskr was started as a Windows service named ieupdate.T1566.001 · Spearphishing AttachmentUAC-0099 gained initial access using a spearphishing email with a malicious attachment.T1573 · Encrypted ChannelYggdrasil provides end-to-end-protected IPv6 communication between network peers used by MythicRatatoskr.T1678 · Delay ExecutionSome MythicRatatoskr samples use a 10-minute startup delay before connecting to Yggdrasil.
Threat Actors
Malware
IndustroyerThe Sandworm group uses such advanced malware as Industroyer, which is able to communicate with equipment at energy companies via industrial control protocols.Industroyer2In April 2022, CERT‑UA thwarted an attack against an energy company in Ukraine where the Sandworm group tried to deploy a new variant of this malware, Industroyer2.LONEPAGEApart from MATCHBOIL, the group also typically deploys LONEPAGE, a PowerShell downloader named after the presence of the word page in its C&C URLs.MatchBoilA minute later, MATCHBOIL was deployed. MATCHBOIL is a downloader that deployed, in this case, the MATCHWOK backdoor (C&C: https://uztickets[.]com) from https://egyptanimals[.]com/animals/photoalbum.MatchWokOn July 16th, 2025, UAC-0099 gained initial access to a grain logistics company in Ukraine via a spearphishing email with a malicious attachment, leading to the execution chain of the MATCHWOK backdoor.MythicRatatoskrIt particularly focuses on the MythicRatatoskr backdoor, which is unique in its use of the Yggdrasil mesh network to communicate with a C&C server hosted within it.NotPetyaIn June 2017 Sandworm launched the NotPetya data-wiping attack that used a supply-chain vector by compromising the Ukrainian accounting software M.E.Doc.Olympic DestroyerIn February 2018, Sandworm launched the Olympic Destroyer data-wiping attack against organizers of the 2018 Winter Olympics in Pyeongchang.
Products
Microsoft Active DirectoryThe data-wiping attack was executed by deploying the SDelete utility via Active Directory Group Policy – standard Sandworm tactics, techniques, and procedures (TTPs) that we have observed numerous times in ESETOpenSSHOur telemetry further shows that additional MythicRatatoskr samples were subsequently deployed to other machines within the organization, this time using an OpenSSH SFTP server.YggdrasilIt particularly focuses on the MythicRatatoskr backdoor, which is unique in its use of the Yggdrasil mesh network to communicate with a C&C server hosted within it.
Tools
bindProxyThe tool is internally named bindProxy.revsocksMost of the code was copied from existing open-source projects, such as revsocks, as implied by the presence of debug strings like Accepting stream and Passing off to socks5, and the function name connectForSocks.SDeleteThe data-wiping attack was executed by deploying the SDelete utility via Active Directory Group Policy – standard Sandworm tactics, techniques, and procedures (TTPs) that we have observed numerous times in ESETyggstackThere’s also another project, called yggstack, that enables the Yggdrasil network to communicate via a network stack in the user space.