ESET says a previously undocumented backdoor called MythicRatatoskr was used in an intrusion that later culminated in a destructive attack against an unnamed Ukrainian grain logistics company. In research published October 22, the cybersecurity firm said Russia-aligned group UAC-0099 gained initial access on July 16, 2025, through a spear-phishing email with a malicious attachment.
According to ESET, attackers deployed MythicRatatoskr the following day. The Go-based backdoor used the decentralized Yggdrasil mesh network to reach its command-and-control server, making the infrastructure harder to locate. ESET said the malware can execute commands, transfer files, capture screenshots and provide proxying capabilities. The firm said it had not observed the backdoor elsewhere and found indications that a Linux variant may exist.
ESET attributed the initial intrusion to UAC-0099 with high confidence and said the access was later handed to Sandworm, which it also attributes with high confidence to the destructive activity. The researchers said the data-wiping operation occurred on September 17, 2025, when attackers deployed Microsoft’s legitimate SDelete utility through Active Directory Group Policy. ESET has not identified the victim company or confirmed whether the attack disrupted its grain operations.
The researchers describe Yggdrasil as an encrypted IPv6 overlay mesh, but note that the network is not designed to provide anonymity. The report includes technical details and indicators of compromise for defenders investigating related activity. The use of unconventional infrastructure to conceal command-and-control traffic echoes other campaigns, including Volt Typhoon’s use of the Silent Train network.
ESET’s technical report details the backdoor, the attack timeline and the researchers’ attribution assessment. The company says this is the first documented case it has seen of a state-aligned threat actor using Yggdrasil in this way.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
