ESET researchers discovered MythicRatatoskr — a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network — that paved the way for a destructive attack against a Ukrainian grain firm. Russia-aligned APT group UAC-0099 gained initial access and handed it off to another Russia-aligned group, Sandworm, which then conducted a data-wiping attack.
The handover documented in the released report is not an isolated phenomenon: Earlier in 2025, ESET Research uncovered that Russia-aligned Gamaredon collaborated with Turla, another Russia-aligned threat actor. Sandworm is attributed to GRU Unit 74455, and in conjunction with known targeting, ESET assesses that UAC-0099 is also aligned with Russian interests. Furthermore, ESET assesses that UAC-0099 can act as an initial access group for Sandworm.
Yggdrasil is a decentralized mesh network that implements an experimental routing scheme in which the IPv6 communication between the nodes is end-to-end protected. “The word ‘Yggdrasil’ originates in Norse mythology, where it refers to a sacred tree connecting the different realms of the cosmos. Within that tree lives a squirrel named Ratatoskr that carries messages between the tree’s top and its roots. Given the backdoor’s role as a messenger scurrying through the Yggdrasil network, we decided to name the backdoor MythicRatatoskr,” explains ESET researcher Peter Strýček, who co-discovered MythicRatatoskr along with Cherepanov.
The post-compromise execution chain relied on known malware already attributed to UAC-0099 — namely the MATCHBOIL downloader and the MATCHWOK backdoor — leading ESET to attribute this stage of the attack to UAC-0099 with high confidence. ESET researchers attribute the data-wiping activity observed two months later to Sandworm (also with high confidence, based on the TTPs involved). According to ESET telemetry, the initial access gained by UAC-0099 was later used in an activity that culminated in the destructive Sandworm operation.
MythicRatatoskr supports standard backdoor functionality, including command execution, filesystem navigation, file transfer, screenshot capture, and proxying. The backdoor was probably used to deploy a SOCKS5 server to route connections through the compromised network.
UAC-0099 is a cyberespionage group targeting governmental organizations, financial institutions, and media, all in Ukraine. Based on the targeting, ESET believes with medium confidence that the group is aligned with Russian interests. Sandworm is a Russia-aligned threat group that performs destructive attacks.
ESET Research presented its findings about MythicRatatoskr at LABScon on September 18, 2026, and at the Virus Bulletin conference on October 16, 2026.
For more technical details, check out the ESET Research blogpost “MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC 0099-Sandworm collaboration” on WeLiveSecurity.com.
Related
This entry was posted on October 22, 2026 at 1:20 pm and is filed under Commentary with tags ESET. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Russia-aligned UAC-0099 and Sandworm cooperate in wiping attack against Ukraine, ESET Research discovers
ESET researchers discovered MythicRatatoskr — a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network — that paved the way for a destructive attack against a Ukrainian grain firm. Russia-aligned APT group UAC-0099 gained initial access and handed it off to another Russia-aligned group, Sandworm, which then conducted a data-wiping attack.
The handover documented in the released report is not an isolated phenomenon: Earlier in 2025, ESET Research uncovered that Russia-aligned Gamaredon collaborated with Turla, another Russia-aligned threat actor. Sandworm is attributed to GRU Unit 74455, and in conjunction with known targeting, ESET assesses that UAC-0099 is also aligned with Russian interests. Furthermore, ESET assesses that UAC-0099 can act as an initial access group for Sandworm.
Yggdrasil is a decentralized mesh network that implements an experimental routing scheme in which the IPv6 communication between the nodes is end-to-end protected. “The word ‘Yggdrasil’ originates in Norse mythology, where it refers to a sacred tree connecting the different realms of the cosmos. Within that tree lives a squirrel named Ratatoskr that carries messages between the tree’s top and its roots. Given the backdoor’s role as a messenger scurrying through the Yggdrasil network, we decided to name the backdoor MythicRatatoskr,” explains ESET researcher Peter Strýček, who co-discovered MythicRatatoskr along with Cherepanov.
The post-compromise execution chain relied on known malware already attributed to UAC-0099 — namely the MATCHBOIL downloader and the MATCHWOK backdoor — leading ESET to attribute this stage of the attack to UAC-0099 with high confidence. ESET researchers attribute the data-wiping activity observed two months later to Sandworm (also with high confidence, based on the TTPs involved). According to ESET telemetry, the initial access gained by UAC-0099 was later used in an activity that culminated in the destructive Sandworm operation.
MythicRatatoskr supports standard backdoor functionality, including command execution, filesystem navigation, file transfer, screenshot capture, and proxying. The backdoor was probably used to deploy a SOCKS5 server to route connections through the compromised network.
UAC-0099 is a cyberespionage group targeting governmental organizations, financial institutions, and media, all in Ukraine. Based on the targeting, ESET believes with medium confidence that the group is aligned with Russian interests. Sandworm is a Russia-aligned threat group that performs destructive attacks.
ESET Research presented its findings about MythicRatatoskr at LABScon on September 18, 2026, and at the Virus Bulletin conference on October 16, 2026.
For more technical details, check out the ESET Research blogpost “MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC 0099-Sandworm collaboration” on WeLiveSecurity.com.
Share this:
Like this:
Related
This entry was posted on October 22, 2026 at 1:20 pm and is filed under Commentary with tags ESET. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.