MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration

On July 16, 2025, UAC-0099 initiated a spearphishing attack against a Ukrainian grain logistics company deploying the MATCHWOK backdoor. The next day, MythicRatatoskr, a previously undocumented Go-based backdoor, was introduced. MythicRatatoskr uses the Yggdrasil mesh network, a decentralized IPv6 overlay network with end-to-end encryption, to communicate with its command and control infrastructure, complicating detection and analysis. Approximately two months later, Sandworm executed a destructive data-wiping attack using the SDelete utility deployed through Active Directory Group Policy. The backdoor supports multiple functionalities including command execution, file transfer, screenshot capture, and SOCKS5 proxying. This attack demonstrates collaboration between UAC-0099 (initial access broker) and Sandworm (destructive actor) and is the first documented case of state-aligned actors exploiting Yggdrasil for C2.

The threat enables persistent unauthorized access to targeted systems with capabilities for executing arbitrary commands, transferring files, capturing screenshots, and proxying network traffic. The use of the Yggdrasil mesh network for command and control complicates detection and network-based mitigation due to its decentralized and encrypted nature. The coordinated attack resulted in destructive data wiping, causing potential operational disruption and data loss for the victim organization.

No official patch or remediation is indicated for this malware. Detection and mitigation efforts should focus on monitoring for spearphishing attempts, unusual use of Active Directory Group Policy for software deployment, and network traffic consistent with Yggdrasil mesh network communications. Endpoint detection should look for behaviors associated with MythicRatatoskr capabilities such as command execution, file transfer, and SOCKS5 proxying. Given the decentralized and encrypted nature of the C2 channel, network-based detection may be challenging. Organizations should apply standard defenses against spearphishing and monitor for indicators of compromise related to UAC-0099 and Sandworm activity.