Executive summary This report analyzes activity during which UAC‑0099 gained initial access on July 16th, 2025 and handed it off to Sandworm, which then conducted a data-wiping attack on September 17th, 2025. It particularly focuses on the MythicRatatoskr backdoor, which is unique in its use of the Yggdrasil mesh network to communicate with a C&C server hosted within it. We presented our findings about MythicRatatoskr at LABScon on September 18th, 2026, and at the Virus Bulletin conference on October 16th, 2026. Key points of this blogpost: On July 16th, 2025, UAC-0099 gained initial access to a grain logistics company in Ukraine via a spearphishing email with a malicious attachment, leading to the execution chain of the MATCHWOK backdoor. One day later, the attackers deployed…