Red Team

Sandworm wiper attack used backdoor hidden in Yggdrasil mesh network

ESET links a Ukrainian grain firm wipe to a UAC-0099 and Sandworm handoff using MythicRatatoskr, a backdoor with C2 inside the Yggdrasil mesh.

Abstract mesh network graphic illustrating a backdoor hidden in the Yggdrasil decentralised network

ESET has linked a destructive wiper attack on a Ukrainian grain logistics company to a handoff between Russia-aligned UAC-0099 and Sandworm, with the access maintained through a new backdoor that talks to a command server hidden inside the Yggdrasil mesh network. The tradecraft is aimed at Ukraine today, but much of it could work just as well against a UK network that relies on outbound filtering and trusts its own Group Policy.

What happened

On 22 October 2026 researchers Anton Cherepanov and Peter Strýček of ESET published their analysis of an intrusion at an unnamed grain logistics firm in Ukraine. The findings were first aired at LABScon and Virus Bulletin.

The timeline runs across two months in 2025. On 16 July a spear-phishing email carrying a malicious attachment gave UAC-0099 its foothold, triggering the group’s known MATCHBOIL downloader and MATCHWOK backdoor. The following morning a previously undocumented implant arrived on the same machine. ESET has named it MythicRatatoskr, after the messenger squirrel of Norse myth. Further copies were later spread to other hosts over an OpenSSH SFTP server.

Then, on 17 September, the company’s systems were wiped. ESET attributes the destructive stage with high confidence to Sandworm, the unit Western governments tie to Russia’s military intelligence service, the GRU (Unit 74455). The firm assesses that UAC-0099, which it considers Russia-aligned with medium confidence, acted as an initial access group and passed the environment on. ESET says it has not seen MythicRatatoskr anywhere else, and it could not establish which of the two groups was operating the backdoor itself.

The technical picture

MythicRatatoskr is a Go implant with the usual post-exploitation toolkit: command execution through cmd.exe, two-way file transfer, screenshots, a reverse SOCKS5 proxy and the ability to switch command servers. It installs as a Windows service called ieupdate and, in some samples, sleeps for ten minutes before reaching out, which ESET reads as an evasion measure. Clues in its configuration hint that a Linux build may exist.

The interesting part is the network layer. Rather than calling a VPS or a compromised website, the backdoor joins Yggdrasil, an experimental, decentralised mesh network in which each node derives an IPv6 address from its own Ed25519 key pair. Traffic between peers is encrypted end to end. Each sample carries an encoded list of 32 public Yggdrasil peers, picks three at random and joins the mesh through them to reach its command server.

From a defender’s perspective that design removes the usual anchor. There is no suspicious domain to sinkhole and no single hosting provider to approach for a takedown, and a proxy or firewall that only sees a connection to a public peer will not see the true destination. ESET notes the limits: Yggdrasil was never designed for anonymity, so the infrastructure is not untraceable. It describes this as the first documented case of a state-aligned actor abusing Yggdrasil in this way, and suggests it “may signal a broader trend” toward experimental peer-to-peer infrastructure.

The wiper stage, by contrast, was deliberately unglamorous. Sandworm used SDelete, Microsoft’s own secure deletion utility, and distributed it through Active Directory Group Policy. ESET says that combination is standard Sandworm practice it has observed many times, and The Hacker News points out that Sandworm’s NikoWiper malware is itself derived from SDelete.

Timeline of the UAC-0099 and Sandworm attack on a Ukrainian grain logistics firm, from phishing in July 2025 to wiping in September 2025

Why it matters for UK organisations

None of the sources reports a UK victim, and this campaign was aimed squarely at Ukraine’s agricultural supply chain. The relevance is my own analysis. The UK already treats this unit as a threat: in July 2025, as the NCSC exposed separate GRU malware, the government sanctioned GRU Unit 74455, which it identifies as Sandworm, and the NCSC has previously called out the unit’s Cyclops Blink malware. Logistics, freight forwarding, ports, agriculture and food distribution businesses with Ukrainian partners, customers or subsidiaries sit closest to this risk.

Three elements should concern UK defenders. First, the division of labour: one actor phishes and holds the door open, a second arrives weeks later to destroy. That means the noisy, destructive event may be the first thing you notice, long after the real compromise. Second, command and control that rides an encrypted overlay network defeats detection strategies built on domain reputation and outbound allow-lists, which many UK mid-market networks still lean on heavily. Third, wiping through Group Policy turns your own management plane into the delivery mechanism, so a single compromised privileged account can reach every domain-joined machine in minutes.

For operators in scope of the UK’s Cyber Security and Resilience Bill, the handoff model is also a reminder that incident reporting clocks and board-level resilience planning need to assume a dwell period, not a single moment of attack.

Expert view

When we run red team engagements, the hardest thing for most blue teams to spot is not the exotic implant, it is the legitimate tool used in the legitimate way. Sandworm’s choice of SDelete pushed by a GPO is exactly that. There is no malicious binary to match: it is administrative tooling doing its job, at scale, at the worst time.

The Yggdrasil piece is more novel, but I would resist treating it as magic. Overlay networks have to bootstrap through something reachable, and here it is a hardcoded list of public peers. In my experience, organisations that genuinely enforce default-deny egress, and that alert on unfamiliar processes making outbound connections rather than only on known-bad destinations, are well placed to catch this. Those that let any workstation talk to anything on port 443 are not.

The handoff between groups is what I would brief to a board: treat phishing footholds and unexplained remote access as potential precursors to destruction, not low-priority hygiene.

What to do now

  1. Hunt for the published indicators. ESET has released hashes, host artefacts such as the ieupdate service and the .updatecache configuration path, the full list of embedded Yggdrasil peers and a command server address in its malware-ioc GitHub repository. Load them into EDR and SIEM tooling.
  2. Block and alert on Yggdrasil and similar overlays. Blocking the public peer addresses is ESET’s own suggested mitigation. Unless you have a business need, treat any connection to mesh or peer-to-peer overlays from corporate endpoints as an incident.
  3. Move towards default-deny egress. Route outbound traffic through an authenticated proxy and alert on processes that bypass it. This maps to the Cyber Essentials firewall control, which is more effective when applied to outbound traffic as well as inbound.
  4. Lock down Group Policy. Restrict who can create or link GPOs, monitor GPO changes and new scheduled tasks or software deployments in real time, and keep tier-zero administrative accounts separate from day-to-day work, in line with the user access control requirements of Cyber Essentials.
  5. Prove your recovery. Keep offline or immutable backups and rehearse a rebuild assuming every domain-joined host has been wiped.

Bottom line

This attack pairs a genuinely new trick, command and control hidden in a decentralised mesh, with the oldest trick in the destructive playbook, abusing the victim’s own administration tools. UK organisations with links to Ukraine, and anyone in logistics or critical infrastructure, should assume this blueprint will be reused. Tight egress control, close watch on Group Policy and tested recovery plans are what blunt it.

Sources

Related Posts