According to ESET, on July 16, 2025, UAC-0099 gained access to a Ukrainian logistics company's network through a spear-phishing email with a malicious attachment, after which the MATCHBOIL downloader installed the MATCHWOK backdoor.1 A day later, a previously undocumented backdoor, MythicRatatoskr, was deployed; its command-and-control server is hosted in the peer-to-peer Yggdrasil mesh network. It runs commands via cmd.exe, takes screenshots, transfers files and launches a reverse SOCKS5 proxy. Some samples include a 10-minute startup delay, likely to evade detection.1 Sandworm then received access and, on September 17, 2025, wiped data by distributing the SDelete utility through Active Directory Group Policy.1 ESET researchers call this the first documented case known to them of a state-aligned group abusing Yggdrasil this way and say it may signal a broader trend; this is their assessment, not established fact.1 References to "crond" in the code suggest a possible Linux version, which is unconfirmed.1 In the editors' view, defenders should scrutinize email attachments and monitor Group Policy changes and unusual peer-to-peer traffic.

  1. [1] Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine AttackThe Hacker News