ESET links UAC-0099 and Sandworm in Ukraine grain firm wiper attack
ESET Research has published findings detailing how two Russia-aligned threat groups coordinated a destructive attack against a Ukrainian grain logistics firm in mid-2025. The operation involved UAC-0099 securing initial access before handing off to Sandworm, the group attributed to GRU Unit 74455, which then conducted a data-wiping campaign roughly two months later.
Central to the intrusion was a previously undisclosed Go-based backdoor that ESET has named MythicRatatoskr. The malware conceals its command-and-control infrastructure inside Yggdrasil, a decentralised mesh network that provides end-to-end encrypted IPv6 routing between nodes. ESET researcher Anton Cherepanov described the timeline: on 16 July 2025, UAC-0099 gained a foothold via a spear-phishing email targeting the company, executing the MATCHWOK backdoor; the following day, MythicRatatoskr was deployed. ESET notes it has not observed the backdoor in any other intrusion and has found indications that a Linux variant may also exist.
The attack chain
The post-compromise execution chain drew on malware families already attributed to UAC-0099: the MATCHBOIL downloader and the MATCHWOK backdoor. ESET attributes this stage to UAC-0099 with high confidence. The subsequent data-wiping activity, observed approximately two months after the initial compromise, is attributed to Sandworm with equally high confidence, based on the tactics, techniques and procedures involved.
MythicRatatoskr supports standard backdoor capabilities: command execution, filesystem navigation, file transfer, screenshot capture, and network proxying. ESET assesses it was likely used to deploy a SOCKS5 server to route connections through the compromised environment, facilitating the later-stage Sandworm operation.
Peter Strýček, who co-discovered the malware alongside Cherepanov, noted the rationale for the name: Ratatoskr is a squirrel in Norse mythology that carries messages through the Yggdrasil world tree. The naming mirrors the backdoor's role as a covert messenger traversing the mesh network's hidden channels.
Broader pattern of Russian threat-actor collaboration
The handoff documented in this case is not an isolated incident. Earlier in 2025, ESET Research revealed a separate collaboration between Gamaredon and Turla, two other Russia-aligned threat groups. The recurrence of this access-broker model, where a specialist intrusion group secures and maintains a foothold that is then handed to a separate destructive operator, represents a notable evolution in how Russian state-aligned cyber activity is structured.
UAC-0099 has historically targeted Ukrainian government bodies, financial institutions and media outlets. ESET assesses with medium confidence that the group serves Russian strategic interests, and now considers it a plausible initial-access provider for Sandworm operations more broadly.
The findings carry significant implications for defenders. The use of Yggdrasil as a C&C channel complicates detection: standard network-monitoring tools that rely on domain or IP reputation feeds will not flag traffic to mesh-network nodes in the same way they would conventional command-and-control infrastructure. Organisations in critical sectors across Ukraine and allied nations should review whether their network visibility extends to non-standard routing protocols.
ESET presented these findings at the LABScon security conference on 18 September 2026 and at Virus Bulletin on 16 October 2026. Full technical detail is available in the ESET Research blog post on WeLiveSecurity.com. The attack underscores a sustained pattern of Russian cyber operations targeting Ukrainian agricultural and logistics infrastructure, a sector that has faced persistent pressure alongside kinetic military activity.