- ESET found a new backdoor, MythicRatatoskr, whose control server sat inside the public Yggdrasil mesh network. It preceded a data-wiping attack on a Ukrainian grain logistics company.
- ESET says UAC-0099 broke in and handed access to Sandworm. The wipe came about two months after the break-in.
- Teams can block the public peer addresses ESET lists, review outbound network rules, and set alerts for Group Policy changes.
Blocking the server is hard when no one owns it
Security teams usually handle a bad server by blocking it. That works when the attacker rents a machine you can name. ESET describes a case where the control server sat inside a decentralized mesh network. No single company ran that network.
ESET traced the case to a grain logistics company in Ukraine. A group it tracks as UAC-0099 got in on July 16, 2025. The entry point was a spearphishing email with a malicious attachment.
The next day, the attackers installed a backdoor nobody had documented before. ESET named it MythicRatatoskr. On September 17, 2025, ESET detected data-wiping activity at the same company. ESET attributes that activity to Sandworm, which it links to GRU Unit 74455.
How the control server stayed inside the mesh
Yggdrasil is a decentralized mesh network. Devices connect directly, with no central hub. Traffic is encrypted from end to end. ESET says legitimate users run it for resilient connectivity, research and hobby networking.
Each node makes its own key, and its network address comes from that key. MythicRatatoskr makes a new key each time it starts. So the infected machine's address changes with every run.
The backdoor carries a fixed list of 32 public peers. It picks three at random to join the public network. It then contacts its control server over HTTPS on port 443, inside the mesh.
ESET says this may stop network security tools from seeing the outbound connections. The malware is written in Go and built on an open-source project called yggstack. That lets it run without creating a tunnel interface on the machine. Some samples wait ten minutes before connecting. ESET says this likely helps avoid detection.
Yggdrasil does not offer anonymity. ESET drew its own map of the network and found the server near the center of the tree. Even so, ESET says this kind of infrastructure made the server's physical location hard to determine.
The backdoor runs commands, moves files, takes screenshots and proxies traffic. ESET believes it was used to install a separate SOCKS5 server. That is a tool that routes other connections through a compromised machine.
Two groups, two jobs
ESET describes UAC-0099 as a cyberespionage group. It targets Ukrainian government bodies, financial institutions and media. Sandworm is best known for destructive attacks in Ukraine. ESET lists the 2017 NotPetya data-wiping attack among them.
ESET assesses with high confidence that UAC-0099 handed access to Sandworm. It could not tell which of the two groups operated MythicRatatoskr.
The wipe used SDelete, a file-erasing utility. It was pushed out through Active Directory Group Policy. Group Policy is the central tool that sends settings and software to managed Windows computers. ESET says this matches Sandworm's usual methods. In effect, the company's own management system delivered the wipe.
Passing access between groups has precedent. ESET documented Gamaredon working with Turla earlier in 2025. It says Gamaredon also worked with InvisiMole. ESET calls the UAC-0099-to-Sandworm pairing unusual in its actors, but the pattern "no longer surprising".
The Hacker News adds that an earlier ESET activity report described UAC-0099 passing "validated targets" to Sandworm. ESET confirmed to the outlet that this case was among those attacks.
The lesson here is about timing. The group that opens the door may not be the group that does the damage. In this case, about two months passed between the two. That is one documented case. It does not show how long every handoff takes.
What to ask your team
ESET points to one practical step: block the public peer addresses the malware uses to join the network. That helps. The wider question is whether servers and workstations should reach peer-to-peer networks at all. Ask whether outbound traffic is denied by default. Ask who approved each exception.
Ask whether your tools alert on the traces ESET lists. They include a scheduled task named pdfopentask and a Windows service named ieupdate. They also include a registry value named UpdateMonitor. ESET says it published full indicators of compromise on GitHub.
Ask who is told when Group Policy starts distributing new software. Ask whether a second person reviews it. A change pushed this way can reach many managed machines at once.
Finally, ask what happens after a phishing case is closed. If the file is removed and the matter ends, a second stage may remain.
ESET says it has not seen the backdoor used anywhere else. It also found signs that a Linux version may exist. A blocklist records where attackers have been. An outbound policy decides where your machines may go.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: ESET.
