Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

MythicRatatoskr is a Go-based backdoor leveraging the Yggdrasil mesh network for encrypted, decentralized command and control communications. It was deployed in a coordinated attack involving UAC-0099 and Sandworm targeting a Ukrainian grain logistics company in mid-2025. The backdoor provides typical malicious capabilities such as command execution, file transfer, screenshot capture, and SOCKS5 proxying. The attack sequence included initial access via spearphishing, backdoor deployment, and a subsequent destructive data-wiping phase using SDelete via Active Directory Group Policy. This incident marks the first known use of Yggdrasil by state-aligned threat actors for C2 communications.

On July 16, 2025, UAC-0099 initiated a spearphishing attack against a Ukrainian grain logistics company deploying the MATCHWOK backdoor. The next day, MythicRatatoskr, a previously undocumented Go-based backdoor, was introduced. MythicRatatoskr uses the Yggdrasil mesh network, a decentralized IPv6 overlay network with end-to-end encryption, to communicate with its command and control infrastructure, complicating detection and analysis. Approximately two months later, Sandworm executed a destructive data-wiping attack using the SDelete utility deployed through Active Directory Group Policy. The backdoor supports multiple functionalities including command execution, file transfer, screenshot capture, and SOCKS5 proxying. This attack demonstrates collaboration between UAC-0099 (initial access broker) and Sandworm (destructive actor) and is the first documented case of state-aligned actors exploiting Yggdrasil for C2.

MythicRatatoskr is a Go-based backdoor leveraging the Yggdrasil mesh network for encrypted, decentralized command and control communications. It was deployed in a coordinated attack involving UAC-0099 and Sandworm targeting a Ukrainian grain logistics company in mid-2025. The backdoor provides typic

MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration

Threats Tagged 'yggdrasil'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'yggdrasil'

Lead Pen Test Professional