MythicRatatoskr: ESET documents a Go backdoor that hides its command server inside the Yggdrasil mesh network, and a UAC-0099 to Sandworm access handoff that ended in a Group Policy wiper attack on a Ukrainian grain logistics firm

ESET reports that on 2025-07-16 UAC-0099 gained access to a Ukrainian grain logistics company through a spearphishing attachment: a scheduled task ran a PowerShell payload, the MATCHBOIL downloader deployed the MATCHWOK backdoor, and the next day a previously undocumented Go backdoor, MythicRatatoskr, arrived, which ESET ties to that chain with high confidence because of the timing (ESET Research, 2026-10-22). Further copies reached other machines through an OpenSSH SFTP server, and a SOCKS5 server appeared on some of them (ESET Research, 2026-10-22). About two months later, on 2025-09-17, the SDelete utility was deployed through Active Directory Group Policy, which ESET calls standard Sandworm tradecraft and assesses with high confidence as Sandworm after UAC-0099 handed off the access; ESET could not say which group operated MythicRatatoskr, and it sets the pair beside the earlier Gamaredon and Turla collaboration (ESET Research, 2026-10-22).

The backdoor is built on the user-space yggstack, so it needs no tunnel interface or privileges to join the Yggdrasil mesh, an encrypted IPv6 overlay in the 200::/7 range: it picks three peers at random from an embedded list of public peers and then speaks JSON over HTTPS on port 443 to a command server that has an address only inside the mesh, and some samples wait ten minutes before connecting (ESET Research, 2026-10-22). It runs as a Windows service with an updater-style name, and it exfiltrates files and screenshots over the mesh without staging them (ESET Research, 2026-10-22). ESET notes that hosting the command server in the mesh may prevent network security tools from detecting the outbound connections to it and that blocking the public peer addresses is a viable mitigation (ESET Research, 2026-10-22).

Triage: ESET notes that legitimate users adopt Yggdrasil for resilient connectivity, research and hobby networking, so a single mesh connection needs a business-owner check, while a mesh peer connection together with a service named like an updater is the stronger combination (ESET Research, 2026-10-22).