Overview of the intrusion
ESET researchers uncovered MythicRatatoskr, a backdoor that provided remote access to a Ukrainian grain logistics company and facilitated later destructive actions. The attackers used a private mesh network implementation called Yggdrasil to conceal the command-and-control (C2) infrastructure. Initial access came through the UAC-0099 group, and control later transitioned to the Sandworm group, which performed data-wiping activity that damaged systems.
How initial access was obtained and executed
On 16 July 2025, the intrusion began with a targeted spear-phishing email containing a payload that triggered the MATCHWOK backdoor execution chain. The payload executed an established chain of loaders and implants that matched past UAC-0099 activity: MATCHBOIL (downloader) and MATCHWOK (backdoor). Within 24 hours, attackers launched MythicRatatoskr and connected it to a C2 node hosted over the Yggdrasil mesh network.
Why Yggdrasil matters in this attack
Yggdrasil is an experimental, decentralized IPv6 mesh that forwards traffic across participating nodes with end-to-end encrypted tunnels. Using Yggdrasil for C2 gives attackers the ability to:
– Mask server locations: Communications transit a distributed overlay instead of a single, easily-traceable IP address.
– Resist takedown: Mesh routing lets operators pivot between nodes and maintain uptime when some nodes are disrupted.
– Leverage IPv6-only routes: Many victim environments and defenders focus on IPv4; using IPv6 overlay routes can hinder standard network monitoring.
Technical capabilities of MythicRatatoskr
MythicRatatoskr implements a standard but capable backdoor feature set: remote command execution, filesystem navigation, file upload/download, screenshots, and proxying. ESET observed signs consistent with a Linux variant, though primary samples were Windows-capable. The implant also allowed setting up a SOCKS5 proxy on compromised hosts, enabling the threat actors to route subsequent operations through victim networks.
Operational timeline and actor handoff
The timeline shows a two-stage operation: UAC-0099 gained initial foothold and deployed the execution chain, and after persistence and environment reconnaissance the Sandworm-associated operators used that foothold roughly two months later to carry out a data-wiping campaign. ESET links Sandworm to GRU Unit 74455; prior ESET findings also document inter-actor collaboration among Russian-aligned groups (for example, Gamaredon and Turla in 2025), indicating a pattern of shared access or handoffs.
Attribution signals and why researchers attribute roles
Researchers used multiple signals to attribute actions to UAC-0099 and Sandworm:
– Tooling and execution chains: MATCHBOIL and MATCHWOK are associated with UAC-0099 activity.
– TTP overlap: The initial infection vectors, lateral activity patterns and persistence mechanisms fit UAC-0099 profiles.
– Destructive behavior and timings: The later data-wiping incidents matched Sandworm’s playbook of timed, destructive strikes after prior reconnaissance.
How the attack unfolded technically — step by step
1) Spear-phishing delivery: A tailored email with a malicious attachment or link triggered the chain.
2) Loader execution: MATCHBOIL or a similar downloader fetched subsequent payloads.
3) Backdoor deployment: MATCHWOK established persistence and initial remote access.
4) Secondary implant: MythicRatatoskr was installed to provide broader remote-management features and proxying.
5) C2 over mesh: MythicRatatoskr connected to a C2 node reachable via the Yggdrasil overlay, hiding the operator’s true infrastructure.
6) Reconnaissance and lateral movement: Attackers cataloged assets and prepared for sabotage.
7) Destructive phase: Sandworm operators executed data-wiping tools that irreversibly damaged systems and operational data.
Detection opportunities and telemetry indicators
Defenders can focus on several practical detection points:
– Email forensic indicators: Unusual sender, tailored social engineering language, or attachments with execution chains tied to MATCHBOIL/MATCHWOK.
– Process and network anomalies: Uncommon child processes of email clients or document viewers and outbound connections to IPv6 addresses that do not match expected infrastructure.
– SOCKS5 and proxy usage: Unexpected local SOCKS5 listeners or unusual proxy configurations suggest use of compromised hosts as relays.
– Mesh network signatures: Yggdrasil nodes use specific IPv6 addressing patterns and persistent encrypted tunnels; correlating new IPv6 endpoints with known Yggdrasil CIDR behaviors helps detection.
Containment and remediation priorities
When facing a similar compromise, teams should:
1) Isolate affected hosts: Immediately cut network connectivity for confirmed infected systems, preserve volatile evidence, and capture memory if possible.
2) Hunt for persistence: Search for MATCHWOK/MATCHBOIL artifacts, unusual services, scheduled tasks, and new SSH keys or accounts unusual for environment baselines.
3) Inspect IPv6 traffic and proxy endpoints: Block unfamiliar IPv6 overlay endpoints and disable unauthorized SOCKS5 listeners.
4) Rebuild after wipe risk: If destructive behavior occurred or is likely, prepare clean reimaging of hosts rather than attempting unreliable in-place remediation.
Strategic lessons and operational countermeasures
Several strategic mitigations reduce risk from such chains:
– Harden email and endpoint defenses: Advance attachment sandboxing, robust macro controls, and behavior-based detection for loader activity.
– Monitor IPv6 and overlay protocols: Bring IPv6 and mesh overlay observability into standard monitoring stacks and threat hunts.
– Enforce network segmentation: Limit lateral movement by reducing flat trust boundaries and applying least-privilege network controls for operational systems.
– Coordinate incident response and intelligence: Share telemetry and IoCs rapidly with sectors at risk (critical logistics, agriculture) to spot reuse of implants.
What the MythicRatatoskr case reveals about attacker collaboration
The incident demonstrates a modular campaign architecture where one actor gains and maintains initial access while another brings destructive capability later. This division of labor allows groups to specialize—initial access brokers focus on infiltration and persistence, while destructive operators optimize timing and sabotage. Tracking such handoffs requires telemetry continuity: early detection and containment of initial access can prevent later high-impact actions by a second actor.
Key indicators and IoC categories to prioritize
Prioritize collection of the following IoC categories across detection platforms and threat-sharing feeds:
– Email campaign hashes and subject lines; track filenames and attachment types used in spear-phishing.
– File hashes and sample metadata: MATCHBOIL, MATCHWOK, and observed MythicRatatoskr binaries.
– IPv6 endpoints and Yggdrasil addressing patterns; record timelines of overlay sessions linked to suspicious hosts.
– Signs of SOCKS5 listeners and unexpected proxy configuration; log local port creations and persistent proxy processes.
Conferences and public disclosure timeline
ESET Research publicly presented findings on MythicRatatoskr at LABScon on 18 September 2026 and at Virus Bulletin on 16 October 2026. Those presentations included technical artifacts and telemetry that support detection and hunting in affected sectors.
Final operational takeaway
The campaign shows how mesh-networked C2 and inter-group handoffs amplify risk: disrupting the initial access chain (MATCHBOIL/MATCHWOK) and adding IPv6/overlay network visibility provide the highest leverage to prevent a benign breach from becoming a destructive operation.
Be the first to comment