"To our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor, and it may signal a broader trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure," ESET researchers Anton Cherepanov and Peter Strýček said.
MythicRatatoskr and the Yggdrasil mesh C2
ESET's analysis identifies a previously undocumented backdoor, MythicRatatoskr, that communicates with a command-and-control (C2) server hosted inside the Yggdrasil mesh network. Deployed a day after the MATCHWOK backdoor executed, MythicRatatoskr's functionality is described as straightforward: it sends victim metadata to the C2, polls for new commands, transmits command output, captures screenshots, and uploads and downloads files.
The backdoor also supports changing the current working directory, enumerating directory contents, altering the C2 server URL, executing shell commands via "cmd.exe", and spawning a reverse SOCKS5 proxy. Some artifacts include a 10‑minute startup delay, likely intended to avoid immediately connecting to the Yggdrasil network and evade detection. ESET noted that MythicRatatoskr was used to deploy a SOCKS5 server to route connections through the compromised network.
UAC-0099, MATCHBOIL and MATCHWOK: the initial access chain
According to ESET, initial access in the intrusion was obtained by UAC-0099 (also known as Earth Sirrush) on July 16, 2025. The entry vector was a spear-phishing email with a malware-laced attachment that led to the deployment of the MATCHWOK backdoor via a downloader named MATCHBOIL. MythicRatatoskr was deployed the following day.
ESET's timeline places the likely start of MythicRatatoskr development between December 2024 and February 2025, based on code and artifact analysis. While the incident they investigated compromised a Windows system, ESET also identified source code references to "crond" within MythicRatatoskr that suggest a possible Linux equivalent may exist.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildSandworm's destructive handoff and the use of SDelete
The activity culminated in a destructive wiping attack carried out by Sandworm on September 17, 2025, more than two months after UAC-0099 first obtained a foothold. ESET reported that Sandworm dropped the SDelete utility via Active Directory Group Policy to perform the wipe. The company also noted the Sandworm-linked NikoWiper malware is derived from SDelete.
Crucially, ESET's assessment describes a two-stage operation: one actor (UAC-0099) conducted initial access and post-exploitation to deliver validated targets, then handed access to Sandworm, which executed the destructive phase.
Cooperation among Russia-aligned threat actors
ESET framed the incident as part of an established pattern of cooperation among Russia-aligned groups. In its APT Activity Report Q2 2025–Q3 2025, ESET said it observed UAC-0099 conducting initial access operations and transferring "validated targets" to Sandworm for further post-exploitation, with targeting that included government, energy, logistics, and grain sectors in Ukraine.
Previous examples of such collaboration cited by ESET include evidence that Gamaredon and Turla worked together, with one intrusion leveraging Gamaredon's PteroGraphin to deploy Turla's Kazuar backdoor, and a Gamaredon-linked downloader called Pterodo being used to retrieve and execute InvisiMole. "This kind of cooperation underscores the potential for coordinated cyber espionage campaigns among Russia-aligned groups, likely intended to amplify their operational impact," ESET said.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: watch for backdoors that use peer-to-peer infrastructures like Yggdrasil and for artifacts such as delayed startup behavior and SOCKS5 staging; ESET's report links these elements directly to the intrusion chain that began with MATCHBOIL and MATCHWOK.
- Policymakers and regulators: the documented handoff from initial-access actors to a destructive group—UAC-0099 to Sandworm—highlights the operational separation of access and destructive capabilities, a pattern ESET has observed in its Q2–Q3 2025 APT report.
- Affected enterprises (logistics, government, energy, grain): the incident shows how initial compromise may be maintained for months before a destructive phase; protective measures should consider detection of unusual C2 choices such as mesh networks and activity like deployment of SDelete via Group Policy.
The ESET findings place a new technical twist on an old operational playbook: initial access by one actor, persistence and tooling by another, and a destructive finish by a third. The notable innovation is the use of MythicRatatoskr with a Yggdrasil-hosted C2 and SOCKS5 routing—a combination ESET describes as the first documented abuse of Yggdrasil by a state-aligned actor. Whether other groups will follow that model remains the open question at the center of this intrusion.
