ESET Details MythicRatatoskr Backdoor Used in Destructive Ukraine Attack
Summary
ESET says UAC-0099 used the previously undocumented MythicRatatoskr backdoor, communicating over the Yggdrasil mesh network, before handing access to Sandworm, which wiped a Ukrainian logistics company's data using SDelete via Active Directory Group Policy.
Key points
- ESET traced initial access on July 16, 2025, to a spear-phishing attachment that led to the MATCHBOIL downloader and MATCHWOK backdoor.
- MythicRatatoskr was deployed the next day and communicated with a command-and-control server hosted inside the Yggdrasil mesh network.
- The backdoor can collect victim metadata, run commands, transmit output, take screenshots, transfer files, and create a reverse SOCKS5 proxy; some samples reportedly had a 10-minute startup delay.
- ESET says UAC-0099 (Earth Sirrush) handed access to Sandworm, which carried out a data-wiping attack on September 17, 2025, using SDelete deployed through Active Directory Group Policy.
- ESET researchers described this as the first documented use of Yggdrasil in this way by a state-aligned threat actor; they said source-code references suggest, but do not confirm, a Linux version.
Article Details
- Attack Vectors
- UAC-0099 gained initial access through a spear-phishing email with a malware-laced attachment, leading to deployment of the MATCHBOIL downloader and MATCHWOK backdoor.
- UAC-0099 later handed access to Sandworm, which deployed the SDelete utility through Active Directory Group Policy for a data-wiping attack.
- MythicRatatoskr communicated with a C2 server hosted inside the Yggdrasil mesh network and could route connections through the compromised network using a SOCKS5 proxy.
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelMythicRatatoskr sent victim metadata, command output, and uploaded files to its C2 server.T1059.003 · Windows Command ShellMythicRatatoskr could execute shell commands through cmd.exe.T1072 · Software Deployment ToolsSandworm used Active Directory Group Policy to deploy the SDelete utility.T1083 · File and Directory DiscoveryMythicRatatoskr could enumerate directory contents.T1090 · ProxyMythicRatatoskr could spawn a SOCKS5 proxy to route connections through the compromised network.T1105 · Ingress Tool TransferMythicRatatoskr could download files to the compromised system.T1113 · Screen CaptureMythicRatatoskr could take screenshots.T1485 · Data DestructionSandworm carried out a data-wiping attack against the Ukrainian logistics company using SDelete.T1566.001 · Spearphishing AttachmentUAC-0099 used a spear-phishing email with a malware-laced attachment to gain initial access.
People
Threat Actors
GamaredonThe article reports prior evidence of cooperation with Turla to target and co-compromise Ukrainian entities.SandwormThe group received access from UAC-0099 and carried out the data-wiping attack.TurlaThe article reports prior cooperation with Gamaredon, including an intrusion in which Turla's Kazuar backdoor was deployed.UAC-0099The group obtained initial access to the Ukrainian target and later transferred access to Sandworm; the article identifies Earth Sirrush as an alias.
Malware
InvisiMoleFurthermore, a Gamaredon-linked downloader called Pterodo has been used to retrieve and execute InvisiMole, a modular spyware program put to use against targets in Ukraine and Russia.KazuarUkrainian entities, with one intrusion leveraging Gamaredon's PteroGraphin to deploy Turla's Kazuar backdoor.MatchBoila malware-laced attachment that led to the deployment of the MATCHWOK backdoor via a downloader called MATCHBOIL.MatchWok2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of the MATCHWOK backdoor via a downloader called MATCHBOIL.MythicRatatoskrWhat makes the attack stand out is UAC-0099's use of a previously undocumented backdoor called MythicRatatoskr that communicates with a command-and-control (C2) server hosted inside the Yggdrasil mesh network. TheNikoWiperthe SDelete utility via Active Directory Group Policy. It's worth noting that the Sandworm-linked NikoWiper malware is also derived from SDelete.PterodoFurthermore, a Gamaredon-linked downloader called Pterodo has been used to retrieve and execute InvisiMole, a modular spyware program put to use against targets in Ukraine and Russia.PteroGraphintogether to target and co-compromise Ukrainian entities, with one intrusion leveraging Gamaredon's PteroGraphin to deploy Turla's Kazuar backdoor.
Vendors
Products
Microsoft Active Directoryculminated with Sandworm carrying out a data-wiping attack by dropping the SDelete utility via Active Directory Group Policy. It's worth noting that the Sandworm-linked NikoWiper malware is also derived fromMicrosoft WindowsWhile the attack investigated by ESET compromised a Windows system, source code references to "crond" within MythicRatatoskr suggest there possibly exists an equivalent Linux version of the malware.Yggdrasilcalled MythicRatatoskr that communicates with a command-and-control (C2) server hosted inside the Yggdrasil mesh network. The backdoor was deployed a day after MATCHWOK was executed.
Tools
Countries
RussiaThis sort of cooperation between Russia-aligned actors is also not new. Last year, ESET said it identified evidence that Gamaredon and Turla were working together to target and co-compromise Ukrainian entities, with oneUkraineThese attacks targeted government, energy, logistics, and grain sectors in Ukraine, the Slovak cybersecurity company noted at the time.
Industries
EnergyThese attacks targeted government, energy, logistics, and grain sectors in Ukraine, the Slovak cybersecurity company noted at the time.GovernmentThese attacks targeted government, energy, logistics, and grain sectors in Ukraine, the Slovak cybersecurity company noted at the time.GrainThese attacks targeted government, energy, logistics, and grain sectors in Ukraine, the Slovak cybersecurity company noted at the time.logisticsThe Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.