How a Backdoor Hid Its Server in Yggdrasil During a Ukrainian Grain Firm Intrusion
ESET says UAC-0099 gained access to a Ukrainian grain logistics firm in 2025 and Sandworm wiped its data; the intrusion also used a backdoor that hides its server in Yggdrasil.
Russia-linked hackers wiped data at a Ukrainian grain logistics company in September 2025, after gaining access through a phishing email in July, according to a report ESET published. ESET attributes the initial access to UAC-0099 and the wiping to Sandworm, a group that Western intelligence agencies link to Russia's GRU military intelligence service. The intrusion also used a previously unknown backdoor, MythicRatatoskr, which reaches its command server through the Yggdrasil mesh network.
ESET does not name the victim. The research was first presented at LABScon in September 2026.
A Ukrainian Grain Logistics Firm Was the Target
ESET describes the victim as a grain logistics company in Ukraine.
ESET says the first access came on 16 July 2025, when a spearphishing email with a malicious attachment led to a PowerShell payload being run. The attackers then deployed the MATCHWOK backdoor, and MythicRatatoskr was delivered to the same machine the next day.
The destructive step came two months later. On 17 September 2025, ESET says, the attackers deployed the SDelete utility via Active Directory Group Policy.
ESET also says additional MythicRatatoskr samples were deployed to other machines in the organization using an OpenSSH SFTP server, and that the attackers probably used the backdoor to deliver a SOCKS5 server.
How a Mesh Network Hides the Command Server
MythicRatatoskr is a Go backdoor that runs as a Windows service named ieupdate. ESET says it joins the public Yggdrasil mesh by picking three peers at random from an embedded list of 32, then reaches its command server inside the mesh over HTTPS on port 443.
Yggdrasil is an experimental routing scheme that provides end-to-end encrypted IPv6 routing between participants, with no built-in points of centralisation, according to the project's own site. Peerings can be configured over TCP or TLS connections. The Record describes the malware as communicating through Yggdrasil instead of a conventional server controlled by the hackers.
ESET says each node generates its own Ed25519 key pair, and its IPv6 address is derived from the public key. ESET also says Yggdrasil is not designed to provide anonymity.
ESET says blocking the public peer addresses is a viable mitigation.
What ESET Can and Cannot Attribute
ESET rates the UAC-0099 initial access and the MATCHWOK chain as high confidence. It also rates the Sandworm wiping, based on tactics, and the handoff from UAC-0099 to Sandworm as high confidence.
UAC-0099 is a Russia-aligned espionage group that, according to The Record, has been active since at least 2022 and has targeted Ukrainian government, finance, media, transport, manufacturing and energy organisations. ESET's researchers say the group can act as an initial-access group for Sandworm.
ESET has not yet determined whether UAC-0099 or Sandworm primarily operated MythicRatatoskr. It rates UAC-0099's alignment with Russian interests as medium confidence. The Record reports that ESET has not seen the backdoor used anywhere else and found indications that a Linux variant may exist.
The Record quotes ESET as saying that, to its knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor.
“ESET says blocking the public peer addresses is a viable mitigation.”
Indicators Security Teams Can Match Against
ESET says a comprehensive list of indicators of compromise and samples is in its GitHub repository. The report lists the detection names WinGo/Agent.ZO for MythicRatatoskr and WinGo/Agent.AOK or WinGo/TrojanProxy.Agent.I for the SOCKS5 tool.
Other observables include configuration files named .updatecache and .crond, the ieupdate service name, and a standalone SOCKS5 tool listening on 127.0.0.1:33690.
ESET's suggested mitigation is blocking the public Yggdrasil peer addresses.
The victim is not named in ESET's report.
