MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration

On July 16, 2025, a grain logistics company in Ukraine became the target of a sophisticated cyberattack when UAC-0099 gained initial access through a spearphishing email containing a malicious attachment. The attack chain quickly evolved, with the deployment of the MythicRatatoskr backdoor the following day—a previously undocumented malware utilizing the Yggdrasil decentralized mesh network for communication with its command-and-control server.

Two months later, on September 17, 2025, the compromised organization fell victim to a data-wiping attack carried out by Sandworm, indicating a handover between the two Russia-aligned threat groups. This collaboration highlights an emerging pattern of cooperation among Russian cyber actors, likely aimed at amplifying their operational impact against Ukrainian targets.

Attack methodology

According to ESET telemetry, the intrusion began at 06:59 on July 16, 2025, when a scheduled task named 'pdfopentask' executed a PowerShell payload. Within a minute, the MATCHBOIL downloader was deployed, which subsequently installed the MATCHWOK backdoor from external domains. The following day, at 09:28, the attackers delivered MythicRatatoskr, a backdoor written in Go that communicates through the Yggdrasil network.

The attackers maintained persistence through registry modifications and deployed additional MythicRatatoskr samples to other machines using an OpenSSH SFTP server. ESET also detected a SOCKS5 server on some compromised machines, likely deployed via MythicRatatoskr. The data-wiping attack in September utilized the SDelete utility deployed through Active Directory Group Policy—standard tactics for Sandworm.

Yggdrasil network

The MythicRatatoskr backder derives its name from Norse mythology, where Ratatoskr is a squirrel that carries messages through Yggdrasil—the cosmic tree connecting different realms. Technically, Yggdrasil is a decentralized mesh network that creates an encrypted IPv6 overlay on the internet, allowing end-to-end protected communication between nodes without a central server.

This decentralized architecture makes the network robust and difficult to disrupt, attractive to adversaries despite not being designed for anonymity. During the attack, MythicRatatoskr sent information about the compromised system to its C&C server and could exfiltrate files and screenshots through the Yggdrasil mesh using HTTPS.

Threat actors collaboration

UAC-0099, a cyberespionage group targeting Ukrainian governmental organizations, financial institutions, and media, has been active since at least 2022. The group is assessed with medium confidence to be aligned with Russian interests and has previously acted as an initial access broker for Sandworm.

Sandworm, attributed to GRU Unit 74455, is known for destructive attacks including the 2017 NotPetya wiper and the 2018 Olympic Destroyer attack. The collaboration between UAC-0099 and Sandworm follows a pattern of cooperation among Russia-aligned groups, such as Gamaredon working with Turla—both linked to Russia's FSB.

ESET researchers presented their findings about MythicRatatoskr at LABScon on September 18, 2026, and at the Virus Bulletin conference on October 16, 2026, highlighting the increasing sophistication of cyber operations targeting Ukrainian infrastructure.