In a significant cyber espionage incident, the Russian hacking group Sandworm, in collaboration with another threat actor, executed a destructive cyberattack on a Ukrainian company specializing in logistics last year. This attack underscores the evolving tactics employed by state-sponsored hackers to disrupt critical infrastructure.
Tactics and Techniques
The cybersecurity firm ESET reported that the attack commenced when UAC-0099, also known as Earth Sirrush, gained initial access on July 16, 2025. This was achieved through a spear-phishing email containing a malicious attachment, which led to the deployment of a backdoor named MATCHWOK via a downloader called MATCHBOIL. Sandworm later took over, implementing a data-wiping attack on September 17, 2025.
One notable aspect of this attack is the use of a previously undocumented backdoor called MythicRatatoskr. This backdoor communicates with a command-and-control server hosted within the Yggdrasil mesh network, marking a novel approach in cyber espionage.
Technical Details of MythicRatatoskr
Development of the MythicRatatoskr backdoor is believed to have begun between December 2024 and February 2025. Its operations involve sending victim metadata to the server, polling for commands, executing those commands, and managing file transfers and screenshots. Additionally, it can manipulate directories, alter server URLs, and execute shell commands.
The backdoor’s design includes a 10-minute delay before connecting to the Yggdrasil network, likely to evade detection. Researchers from ESET, Anton Cherepanov and Peter Strýček, highlighted that this is the first known instance of Yggdrasil being exploited in this context by a state-linked actor.
Broader Implications and Collaborative Efforts
MythicRatatoskr was also used to deploy a SOCKS5 server to channel connections through the compromised network. Sandworm completed the attack by deploying a data-wiping tool, SDelete, via Active Directory Group Policy. The Sandworm-related NikoWiper malware also shares a lineage with SDelete.
While the investigation primarily involved Windows systems, code references suggest the possible existence of a Linux variant of MythicRatatoskr. The ongoing collaboration between UAC-0099 and Sandworm is not unprecedented, as detailed in ESET’s APT Activity Report for mid-2025.
Such cooperation between Russian-aligned cyber actors is indicative of a broader trend. Previously, ESET documented collaboration between groups like Gamaredon and Turla to jointly target Ukrainian entities, highlighting the increasing sophistication and coordination of cyber espionage campaigns.
In conclusion, the attack on Ukraine demonstrates the persistent threat posed by state-sponsored cyber actors and the innovative methods they employ to achieve their objectives. These developments call for enhanced cybersecurity measures and international cooperation to counter such sophisticated threats.
