- ESET says a Russian-aligned spy group broke into a Ukrainian grain logistics firm in July 2025, and Sandworm wiped its data in September.
- Researchers believe the first group passed its access to the second, so an espionage alert may say something about later data loss.
- Leaders should ask how their teams rank spyware alerts, whether backups survive a wiper, and whether they can see traffic to overlay networks.
An alert that says "spyware found" and one that says "data wiped" can describe the same intrusion. In a case reported by The Record, they came two months apart. The idea worth keeping is simple. Access can be passed from one attacker to another, so the first group in your network may not be the last.
What ESET found
ESET, a Slovak security firm, published the findings. They concern an unnamed Ukrainian grain logistics company. By ESET's account, the intrusion started in July 2025. The entry point was a phishing email with a malicious attachment. The group behind it is tracked as UAC-0099 and is described as Russian-aligned and focused on espionage.
First, the intruders planted a backdoor called MatchWok so they could keep coming back. Later they added a tool nobody had seen before, which ESET named MythicRatatoskr. With it, they could control machines from afar, copy files and capture screens.
ESET found no use of that tool anywhere else. Researcher Anton Cherepanov, who investigated the attack, also pointed to signs that a Linux version may exist.
Researchers believe UAC-0099 then passed its access to Sandworm. Western intelligence agencies link Sandworm to Russia's military intelligence service, the GRU. In September, two months after the break-in, Sandworm wiped data at the company.
Why the handoff changes how alerts are ranked
Teams often treat spying as slow and quiet, and data wipes as urgent. This case suggests that split deserves a second look. That is our observation, not a finding from ESET or The Record.
If access moves between groups, a spying alert also says something about what that access could be used for later. Two months passed between the break-in and the wipe. The Record's account does not say whether the company noticed the intruders. So the question for any organisation is whether a quiet backdoor gets the same attention as a visible attack.
How the attack worked
Two details stand out. The first is the goal. Ransomware usually locks files and asks for payment. Wiper malware, The Record explains, is built to destroy data for good and disrupt operations. No ransom can reverse that. Recovery depends on backups the attackers cannot reach.
The second is how the malware hid its traffic. Rather than calling a normal server run by the attackers, it routed through Yggdrasil. This is a decentralized network where devices swap encrypted data without a central hub.
ESET's researchers say they know of no earlier documented case of a state-aligned actor abusing Yggdrasil this way. They note that networks like this can make attacker infrastructure sturdier and harder to trace. In plain terms, defenders may have no single server address to find and block.
A pattern, with limits
ESET describes Russian groups working together as a pattern. Earlier in 2025, it found four cases where Gamaredon and Turla went after the same Ukrainian organizations. Both groups are tied to Russia's Federal Security Service. On this case, the researchers wrote that the handoff was "unusual in the specific actors involved, but no longer surprising as a pattern."
There is also background. Last November, ESET reported that Sandworm carried out several destructive attacks on Ukrainian grain, energy, logistics and government targets between June and September 2025. The Record adds that researchers saw direct strikes on farming businesses as fairly rare.
The limits are clear. This is one company in a war zone. The handoff is what researchers believe, not something proven. ESET could not say which group mainly operated the new backdoor. The findings do not show that other organisations face the same sequence.
Questions to put to your security team
Start with ranking. Does a confirmed backdoor, even one tied to a spying group, get the same response as a wiper alert? Next, ask about recovery. Could you restore core systems from backups that an intruder with administrator rights could not alter or delete?
Then ask about visibility. Can the team see outbound traffic to unusual encrypted networks, not only to known bad servers? Finally, ask how quickly a phishing attachment is caught once it reaches an inbox. That was the way in here.
Within the limits above, the lesson is narrow. In this case, a foothold was reportedly handed on, so it is worth asking what a quiet intruder's access could become.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: The Record.
