ESET researchers discovered a previously unknown backdoor, MythicRatatoskr, was deployed in an intrusion that later culminated in a destructive attack against a Ukrainian grain firm.
Russia-aligned UAC-0099 gained initial access and handed it off to Sandworm. Sandworm is attributed to GRU Unit 74455.
The execution chain relied on known malware already attributed to UAC-0099 – namely the MATCHBOIL downloader and the MATCHWOK backdoor.
BRATISLAVA — October 22, 2026 — ESET researchers discovered MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm. Russia-aligned APT group UAC-0099 gained initial access and handed it off to another Russia-aligned group, Sandworm, which then conducted a data-wiping attack.
The handover documented in the released report is not an isolated phenomenon: earlier in 2025, ESET Research uncovered that Russia-aligned Gamaredon collaborated with Turla, another Russia-aligned threat actor. Sandworm is attributed to GRU Unit 74455, and in conjunction with known targeting, ESET assesses that UAC-0099 is also aligned with Russian interests. Furthermore, ESET assesses that UAC-0099 can act as an initial access group for Sandworm.
“On July 16th, 2025, UAC-0099 gained initial access to a grain logistics company in Ukraine via a spearphishing email with a malicious attachment, leading to the execution chain of the MATCHWOK backdoor. One day later, the attackers deployed MythicRatatoskr that communicates with a command-and-control server hosted inside the Yggdrasil mesh network. We have not seen the backdoor used anywhere else, and we found indications that a Linux variant may also exist,” says ESET researcher Anton Cherepanov who investigated the attack.
Yggdrasil is a decentralized mesh network that implements an experimental routing scheme in which the IPv6 communication between the nodes is end-to-end protected. “The word Yggdrasil originates in Norse mythology, where it refers to a sacred tree connecting the different realms of the cosmos. Within that tree lives a squirrel named Ratatoskr that carries messages between its top and its roots. Given the backdoor’s role as a messenger scurrying through the Yggdrasil network, we decided to name the backdoor MythicRatatoskr,” explains ESET researcher Peter Strýček, who co-discovered MythicRatatoskr along with Cherepanov.
The post-compromise execution chain relied on known malware already attributed to UAC-0099 – namely the MATCHBOIL downloader and the MATCHWOK backdoor – which leads ESET to attribute this stage of the attack to UAC-0099 with high confidence. ESET researchers attribute the data-wiping activity observed two months later to Sandworm, also with high confidence, based on the TTPs involved. According to ESET telemetry, the initial access gained by UAC-0099 was later used in an activity culminating in the destructive Sandworm operation.
MythicRatatoskr supports standard backdoor functionality, including command execution, filesystem , file transfer, screenshot capture, and proxying. The backdoor was probably used to deploy a SOCKS5 server to route connections through the compromised network.
UAC-0099 is a cyberespionage group targeting governmental organizations, financial institutions, and media, all in Ukraine. Based on the targeting, ESET believes with medium confidence that the group is aligned with Russian interests. Sandworm is a Russia-aligned threat group that performs destructive attacks.
ESET Research presented its findings MythicRatatoskr at LABScon on September 18, 2026, and at the Virus Bulletin conference on October 16, 2026. For more technical details, check out the ESET Research blogpost “ MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC 0099-Sandworm collaboration ” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X) , Bluesky , and Mastodon for the latest news from ESET Research.
Yggdrasil map with the C&C server (October 11th, 2025)
ESET protects organizations, critical infrastructure, and individuals, helping them build digital resilience and confidence in an increasingly AI-driven world. With more than 35 years of cybersecurity expertise, over 25 years of AI innovation, and 11 global R&D centers, ESET develops proprietary technologies designed to protect against evolving cyber threats and secure the broader AI ecosystem. Grounded in scientific rigor and taking a preemptive approach to security, ESET delivers effortless protection that remains under expert human oversight. Headquartered in the European Union and privately owned, ESET protects millions of users and more than 500,000 organizations across 178 countries. Committed to responsible AI and customer trust, ESET protects the progress that technology enables. For more information, visit or follow ESET’s social media, podcasts, and blogs .
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
