On the morning of 16 July 2025, a scheduled task ran on one computer at a grain logistics company in Ukraine. Two months later, on 17 September, the same company's data was being wiped. What happened in between was published by ESET researchers on 22 October 2026. The story has two sides: a new backdoor, and a division of labour between two different groups working the same victim. ESET Research, MythicRatatoskr, 22 October 2026
A backdoor is hidden software that lets an attacker return to a victim's computer whenever they wish. A command-and-control server (C&C) is the remote server from which the backdoor takes orders and to which it sends stolen data. An initial access group is the team that manages to break into a victim and hands that access to another group. A mesh network is a network in which devices connect directly to one another without a central server. A wiper is an attack tool that permanently destroys files without asking for ransom.
How did the incident unfold?
According to ESET telemetry, entry came through a spearphishing email with a malicious attachment. First the MATCHBOIL downloader was installed, then the MATCHWOK backdoor. Both tools had previously been documented by CERT-UA and belong to the UAC-0099 group. The next day, 17 July, a new program arrived on the machine: a never-before-seen backdoor ESET named MythicRatatoskr. Over the following days the same backdoor was distributed to other machines in the organisation through an SFTP server. ESET Research
About two months later, on 17 September 2025, ESET detected data-wiping activity. The wiping was carried out by deploying the SDelete utility through Active Directory group policy. ESET recognises this as a tactic observed from Sandworm many times and reaches two conclusions: it attributes the first stage to UAC-0099 with high confidence and the wiping stage, again with high confidence, to Sandworm. It assesses that the access was handed over at some point in between; but it states plainly that it could not determine which group actually operated MythicRatatoskr. ESET Research
| Date | Event | ESET's attribution |
|---|---|---|
| 16 July 2025 | Phishing email, scheduled task, MATCHBOIL and MATCHWOK | UAC-0099 |
| 17 July 2025 | MythicRatatoskr installed; later spread to other machines | UAC-0099 or Sandworm (undetermined) |
| August 2025 | Local SOCKS5 server installed | UAC-0099 or Sandworm (undetermined) |
| 17 September 2025 | SDelete deployed via group policy, data wiped | Sandworm |
Enlarge details
Two groups, one victim
UAC-0099 is an espionage group targeting government bodies, financial institutions and media in Ukraine; looking at its targeting, ESET assesses with medium confidence that it is aligned with Russian interests. Sandworm is the group known for destructive attacks, recognised for the Ukrainian power outages of 2015 and 2016, NotPetya in 2017 and the Industroyer family; it is widely linked to GRU Unit 74455. ESET Research
According to ESET, this hand-off is not an isolated case. In early 2025 the same team documented a similar collaboration between Gamaredon and Turla, both linked to Russia. One group opens the door, the other walks in and does the actual job. For defenders that means this: looking at the tools seen in the first stage and saying "this is an espionage incident" may not be enough to foresee the destruction that arrives two months later. ESET Research
Yggdrasil: a mesh that obscures the destination
What sets MythicRatatoskr apart is not its capabilities. Command execution, file transfer in both directions, screenshots, a proxy: these are ordinary backdoor functions. What differs is how it reaches its command server. The backdoor joins an experimental mesh network called Yggdrasil, and the C&C server is inside that network too. ESET Research
Yggdrasil is a network with no central server that builds an encrypted IPv6 layer on top of the internet. Every node generates its own key pair, and the IPv6 address is derived from that key; the addresses fall in the 200::/7 range, which the IETF deprecated in 2004. Traffic between nodes is protected end to end. The network does not promise anonymity, and ESET used that to map the C&C server's position in the network. But for a network security tool the upshot is this: the connection leaving the victim machine goes not to a known malicious IP but to one of Yggdrasil's public peer nodes. The real destination stays inside that encrypted layer. ESET Research
The backdoor is written in Go and based on the yggstack project; thanks to that it does not need to open a tunnel interface on the system and therefore does not require elevated privileges. A list of 32 public peer nodes is embedded inside it; on every run it picks three of them at random and joins the network. Some samples include a ten-minute start-up delay, which ESET interprets as detection avoidance. For persistence it uses a Windows service named ieupdate. Its settings are kept on disk in an AES-encrypted file; the fact that the file names begin with a dot and some paths use forward slashes suggests to ESET that a Linux variant may also exist. ESET Research
Enlarge details
The measure ESET proposes follows from the method itself: even if the C&C server cannot be located, blocking Yggdrasil public peer addresses is a workable mitigation where the organization has no approved use. The full list of those addresses is at the end of ESET's post. ESET says this is the first documented case of a state-aligned group abusing Yggdrasil in this way and warns that experimental peer-to-peer networks may appear more often in attacker infrastructure. ESET Research
Why is this an OT story?
The victim is a grain logistics firm. ESET's report mentions no PLC, no SCADA and no interference with a physical process; what was destroyed was data. Whether the attack affected OT components could not be verified for this article either. Still, there are three reasons to read the incident from the critical-infrastructure side.
First, the target. Grain logistics is part of the food supply chain; when storage, dispatch and documentation systems stop, the product does not physically move. We have seen in ransomware cases before that production can stop without anyone touching the control system; a similar dependency risk exists here, although ESET does not establish the extent of logistics disruption.
Second, the actor. Sandworm is the group that developed Industroyer, malware able to speak industrial protocols. Even though the method used in this incident was an ordinary system utility and group policy, we should not forget that the same access could be used against another target for another purpose. ESET Research
Third, visibility. An approach relying only on known-bad IP lists may miss important context in this incident. If command traffic goes to the public peers of a mesh network, the perimeter sensor sees a transport connection to a public peer over IPv4 or IPv6. It need not see the inner 200::/7 destination directly. Endpoint processes and connection metadata should therefore be examined together. On both the IT and OT side the question we have to ask changes: not only "where is it connecting" but "is there any reason for this machine to connect there".
What do we look for in the field?
| Observation | Why it matters |
|---|---|
Inner 200::/7 traffic on an endpoint, or perimeter connections to known Yggdrasil peers | Legitimate use of this range is rare on a corporate network |
A service named ieupdate; files such as updater.exe, krbtman.exe, windowsdefendersvc.exe in system directories | Installation paths and service name observed by ESET |
Files named .updatecache or .crond on Windows | Dot-prefixed filenames are unusual on Windows; the dot does not automatically hide them |
| A SOCKS5 server listening on 127.0.0.1:33690 | The local proxy used in the incident |
| SDelete distributed via group policy | Sandworm's data-wiping method |
This table is based on the indicators ESET published; the full list and sample hashes are in ESET's GitHub repository. No single indicator is proof on its own; the name krbtman.exe being used for both the backdoor and the SOCKS5 server is a good example. ESET Research
About two months separated initial access from data wiping. For those two months the organisation's network held a backdoor, a proxy server and traffic flowing into an encrypted mesh. Our question is this:
Would we notice today an encrypted connection leaving our network whose destination we cannot fully name?