MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
Executive summary This report analyzes activity during which UAC‑0099 gained initial access on July 16th, 2025 and handed it off to Sandworm, which then conducted a data-wiping attack on September 17th, 2025. It particularly focuses on the MythicRatatoskr backdoor, which is unique in its use of the Yggdrasil mesh network to communicate with a C&C server hosted within it. We presented our findings about MythicRatatoskr at LABScon on September 18th, 2026, and at the Virus Bulletin conference on October 16th, 2026. Key points of this blogpost: On July 16th, 2025, UAC-0099 gained initial access to a grain logistics company in Ukraine via a spearphishing email with a malicious attachment, leading to the execution chain of the MATCHWOK backdoor. One day later, the attackers deployed MythicRatatoskr, a previously undocumented backdoor that communicates with a C&C server hosted inside the Yggdrasil mesh network. We have not seen the backdoor used anywhere else, and we found indications that a Linux variant may also exist. Yggdrasil is a decentralized mesh network that implements an experimental routing scheme in which the IPv6 communication between the nodes is end-to-end protected. Ultimately, UAC-0099 handed off access to Sandworm, which then carried out a data-wiping attack. Cooperation among Russia-aligned actors The handover documented in this report is not an isolated phenomenon. As noted above, Sandworm is attributed to GRU Unit 74455, and UAC-0099’s targeting leads us to assess that it is aligned with Russian interests. Earlier in 2025, we uncovered that Russia-aligned Gamaredon collaborated with Turla, another Russia-aligned threat actor; we documented our findings in our blogpost Gamaredon X Turla collab. Both groups are linked to the Federal Security Service of the Russian Federation (FSB). This kind of cooperation underscores the potential for coordinated cyberespionage campaigns among Russia-aligned groups, likely intended to amplify their operational impact. In the past, Gamaredon collaborated with a threat actor that we discovered and named InvisiMole. Against that backdrop, a UAC‑0099-to-Sandworm handoff is unusual in the specific actors involved, but no longer surprising as a pattern. Overview of the intrusion According to ESET telemetry, the events unfolded as follows: at 06:59 on July 16th, 2025, a scheduled task named pdfopentask was executed on one machine in the target organization. It executed a PowerShell payload from %temp%\temporarydoc.txt. A minute later, MATCHBOIL was deployed. MATCHBOIL is a downloader that deployed, in this case, the MATCHWOK backdoor (C&C: https://uztickets[.]com) from https://egyptanimals[.]com/animals/photoalbum. The following day, at 09:28, a new binary was delivered to the machine: the MythicRatatoskr backdoor. Due to the close proximity of time, we believe with high confidence that the MATCHWOK execution chain led to the deployment of MythicRatatoskr. Our telemetry further shows that additional MythicRatatoskr samples were subsequently deployed to other machines within the organization, this time using an OpenSSH SFTP server. Later, ESET telemetry detected a SOCKS5 server on some of the machines, with one sample having been extracted from an unknown archive using WinRAR. We believe that the SOCKS5 server was deployed using MythicRatatoskr. Approximately two months later, on September 17th, 2025, we detected data-wiping activity at the compromised grain logistics company. The data-wiping attack was executed by deploying the SDelete utility via Active Directory Group Policy – standard Sandworm tactics, techniques, and procedures (TTPs) that we have observed numerous times in ESET telemetry. Therefore, we assess that UAC‑0099 can act as an initial access group for Sandworm. This blogpost focuses primarily on the analysis of the MythicRatatoskr backdoor, the Yggdrasil network that hosts its C&C server, and the accompanying SOCKS5 server. The first versions of MATCHBOIL and MATCHWOK have already been analyzed by CERT‑UA in its advisory, with MATCHBOIL and its evolution further covered in our blogpost MATCHBOIL: New tricks, same old evil intentions. These tools are therefore omitted here. A squirrel in the world tree The word Yggdrasil originates in Norse mythology, where it refers to a sacred tree connecting the various realms of the cosmos. Within that tree lives a squirrel named Ratatoskr that carries messages between its top and its roots. Given the backdoor’s role as a messenger scurrying through the Yggdrasil network, we decided to name the backdoor MythicRatatoskr. More technically, Yggdrasil is a decentralized mesh network that connects devices directly to each other without a central hub, building an encrypted IPv6 overlay on top of the internet so that participating nodes can exchange end-to-end-protected traffic. Legitimate users adopt such meshes for resilient connectivity, research, and hobby networking. Because no single server runs the mesh, the network is robust and hard to disrupt – properties that also make it attractive to adversaries. Importantly, Yggdrasil is not designed to provide anonymity. Attribution The post-compromise execution chain relied on known malware already attributed to UAC‑0099 – namely the MATCHBOIL downloader and the MATCHWOK backdoor – which leads us to attribute this stage of the attack to UAC‑0099 with high confidence. We attribute the data-wiping activity observed two months later to Sandworm, also with high confidence, based on the TTPs involved. Moreover, we assess with high confidence that UAC‑0099 handed off access to Sandworm at some point during the intrusion, although we have not yet been able to determine whether the MythicRatatoskr backdoor was operated primarily by UAC‑0099 or by Sandworm. UAC‑0099 profile UAC‑0099 is a cyberespionage group targeting governmental organizations, financial institutions, and media, all in Ukraine. Based on the targeting, we believe with medium confidence that the group is aligned with Russian interests. UAC‑0099 can act as an initial access broker for Sandworm, a Russia-aligned group best known for its destructive attacks in Ukraine. The group has been active since at least 2022 and was first reported by CERT‑UA in June 2023. Apart from MATCHBOIL, the group also typically deploys LONEPAGE, a PowerShell downloader named after the presence of the word page in its C&C URLs. Sandworm profile Sandworm is a Russia-aligned threat group that performs destructive attacks. It is mostly known for attacks against Ukrainian energy companies in December 2015 and December 2016, which resulted in power outages. In June 2017 Sandworm launched the NotPetya data-wiping attack that used a supply-chain vector by compromising the Ukrainian accounting software M.E.Doc. In February 2018, Sandworm launched the Olympic Destroyer data-wiping attack against organizers of the 2018 Winter Olympics in Pyeongchang. The Sandworm group uses such advanced malware as Industroyer, which is able to communicate with equipment at energy companies via industrial control protocols. In April 2022, CERT‑UA thwarted an attack against an energy company in Ukraine where the Sandworm group tried to deploy a new variant of this malware, Industroyer2. Since February 2022, Sandworm has been very active in Ukraine, by deploying data wipers against strategic organizations. In October 2020, the US Department of Justice published an indictment against six Russian computer hackers that it alleges prepared and conducted various Sandworm attacks. As we already mentioned, the group is commonly attributed to GRU’s Unit 74455. Compromise chain Initial access and execution According to ESET telemetry, initial access was gained via a spearphishing email with a malicious attachment – a finding that matches CERT‑UA blogpost. We assess that the MATCHWOK backdoor execution chain (already documented in the CERT‑UA blogpost) then led to the execution of MythicRatatoskr, a backdoor that communicates with its C&C server over the Yggdrasil network. Subsequently, the attackers probably used MythicRatatoskr to deliver a SOCKS5 server. Persistence MATCHBOIL persists MATCHWOK by adding the registry value UpdateMonitor to the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\, with data pointing to the dropped MATCHWOK path. MythicRatatoskr is started as a Windows service with the name ieupdate. Collection and exfiltration During check-in, MythicRatatoskr sends information about the current user, hostname, and local network settings to the C&C server. In addition, the operators can use MythicRatatoskr to exfiltrate files and screenshots to the C&C server by using HTTPS routed through the Yggdrasil mesh network. The data is not staged prior to exfiltration. Toolset MythicRatatoskr MythicRatatoskr is a backdoor written in Go that uses the Yggdrasil network (described in the Network protocol section) to reach its C&C server. As noted earlier, we named the backdoor after Ratatoskr, the squirrel from Norse mythology that scurries through Yggdrasil – the sacred tree connecting the realms of the cosmos – carrying messages between its top and its roots. We felt this was a fitting parallel for a backdoor that ferries data across the Yggdrasil network. There are signs in the binaries suggesting that the development started sometime between December 2024 and February 2025. Function names left in the binaries – following a mix of mixed caps (CheckInAgent) and snake case (agent_run) – suggest either code merged from another project or inconsistent naming by the authors. Key functions handle service registration and Yggdrasil network initialization (main, runService), check-in and beaconing (agent_run, init_agent, CheckInAgent), configuration handling (saveConfig, Encrypt, Decrypt), command polling and dispatch (getTasks, doTask), and the backdoor commands themselves (upload, download, screencat, shell, manageProxy, etc.). Some samples also include a 10-minute startup delay, likely to avoid immediately connecting to the Yggdrasil network on execution, helping to evade detection. Host-based artifacts Table 1 presents MythicRatatoskr host-based artifacts that we observed during our analysis. Note the filename collision for krbtman.exe: it is MythicRatatoskr on some machines, and the SOCKS5 server on others. Table 1. Host-based artifacts associated with MythicRatatoskr Persistence According to Windows event logs obtained from the compromised machines, updater.exe and WindowsDefenderSvc.exe were started, and thus likely persisted, as Windows services. Network protocol To communicate with the C&C server, MythicRatatoskr relies on the Yggdrasil network – a decentralized mesh network in an alpha state that implements an experimental routing scheme. Each node in the network generates its own Ed25519 key pair, which allows protected end-to-end IPv6 communication between the peers. The IPv6 address is derived from the public key in the 200::/7 subnet range, which was deprecated by IETF in 2004. Anonymity is not among the goals of the project. We explore this topic more in the Network infrastructure section. The yggdrasil-go repository already provides the necessary types and methods to join the Yggdrasil network. There’s also another project, called yggstack, that enables the Yggdrasil network to communicate via a network stack in the user space. This has the benefit of not needing to create a tunnel interface, which might be an issue if the user does not have the required privileges to create one, or if such an interface is not supported on the system. The MythicRatatoskr code is based on yggstack, making the malware portable. There’s a publicly available network that one can join by adding at least one public peer into the Yggdrasil configuration. MythicRatatoskr specifically contains an embedded base64-encoded blob that contains a list of public peers in the URI format. Most peers on the list are still operational. MythicRatatoskr randomly picks three peers from the hardcoded list, which is the recommended number, and connects to them in order to join this public Yggdrasil network. Once MythicRatatoskr is part of the Yggdrasil network, it communicates with its C&C server, which is also part of the network, via HTTPS on port 443. Communication uses JSON-encoded HTTP POST requests containing a uuid (explained in Table 4, in the MythicRatatoskr main configuration section), a message type, and optional data. Four message types exist: checkin – register the backdoor and send victim metadata such as username, hostname, and local IPs; the server responds with a fresh uuid and psk), tasking – poll for new commands, result – return command output, base64-encoded when present, and getfile – retrieve file content for the upload command. Although the C&C server is hosted in the Yggdrasil network – which may prevent network security tools from detecting outbound connections to it – blocking the public peer addresses is a viable mitigation. Configuration We distinguish between two types of configuration: a backdoor-specific configuration used by the malware itself; and an Yggdrasil configuration used to join the mesh network. The MythicRatatoskr configuration is stored in a file at a hardcoded path. The path can differ in each sample; we identified the following paths: C:\Windows\Temp\.updatecache (in krbtman.exe, Act64.exe, ie.exe, ieupdate.exe, and windowsdefendersvc.exe) C:\Windows\system32\.updatecache (in updater.exe, and windowsdefendersvc.exe) %LocalAppData%/Temp/.crond (only in OneDriveLiveUpdater.exe) The %LocalAppData%/Temp/.crond path is notable, since such a filename (.crond) along with forward slashes is expected for Unix-like systems. This indicates that a Linux variant (or macOS, FreeBSD, etc., though less likely) of MythicRatatoskr may also exist. Moreover, OneDriveLiveUpdater.exe contains an unused configuration path /tmp/.test_config; the filename suggests that this configuration path may have been used during testing and accidentally left in a Windows deployment. All of the configuration filenames start with a dot. On Unix-like systems, programs used for listing files, such as ls, typically exclude these entries by default, effectively hiding them. This is not the case on Windows, where these files are not hidden. This further suggests the existence of a Linux variant. The backdoor-specific configuration stored on disk is a JSON file encrypted via AES‑256‑CFB using a hardcoded key embedded in the binary, US3pM9KFxrZBSgc1pGl2wO4Kir1XjZP5Z9kBXBMYd2s=, which is decoded using base64 before being used. The first 16 bytes of the file represent the IV. The configuration file is not required for the malware to start. MythicRatatoskr contains an embedded default configuration, which it encrypts and writes to disk during initialization. This allows operators to deploy the malware without a separate configuration file and update the configuration later via C&C commands. Backdoor commands are described later in the Capabilities section. Table 2 presents the embedded MythicRatatoskr configuration common for all samples. Table 2. Embedded MythicRatatoskr configuration Although not part of the above configuration, MythicRatatoskr contains the following hardcoded C&C address for the proxy command: 201:b479:2771:8df4:b5eb:d007:63b0[:]2838:8080. It is not possible to modify the value during runtime. Yggdrasil configuration Initially, when MythicRatatoskr starts, it generates a new Yggdrasil configuration, including a new Ed25519 private key. Because the Yggdrasil IPv6 address is derived from the public key, the victim machine’s Yggdrasil IPv6 address changes each time the malware runs. MythicRatatoskr then uses empty NodeInfo data and sets the NodeInfoPrivacy flag. As a result, other nodes in the Yggdrasil network won’t be able to get more information about the node, such as the Yggdrasil version or the operating system on which the node is running. The backdoor uses a publicly available Yggdrasil network to reach the C&C server. To join the network, it needs to connect to at least one of the publicly available peers. All MythicRatatoskr samples contain the same embedded list of 32 peers from which three are randomly picked. The peer list is base64 encoded in the binary and was likely compiled by the backdoor authors from publicly available sources. We provide the full peer list at the end of the blogpost. MythicRatatoskr supports standard backdoor functionality, including command execution, file system navigation, file transfer, screenshot capture, and proxying. Table 3 contains all of the backdoor commands; the command IDs are strings that are hardcoded in the code. Table 3. MythicRatatoskr commands Unlike the standalone SOCKS5 server described below, MythicRatatoskr’s proxy command is used to create a reverse SOCKS5 proxy connection. The standalone tool creates a local SOCKS5 server instead. The SOCKS5 server exclusively used by UAC‑0099 or Sandworm during the August 2025 activity is a simple tool written in Go that uses go-socks5 for managing proxy connections. The tool is internally named bindProxy. Because MythicRatatoskr already includes SOCKS5 proxy functionality (see Table 3), it is unclear why the attackers deployed a separate SOCKS5 server. It is possible that MythicRatatoskr’s proxy command did not work as expected, so the operators installed this additional tool. Nevertheless, together they support both forward and reverse proxying. Host-based artifacts Table 4 presents SOCKS5 server host-based artifacts that we observed during our analysis. Again, note the filename collision for krbtman.exe: it is MythicRatatoskr on some machines, and the SOCKS5 server on others. Table 4. Host-based artifacts associated with the SOCKS5 server Capabilities The tool uses go-socks5 to create a SOCKS5 proxy server that listens on 127.0.0.1, port 33690. The address is specifically used to allow only the local machine to access the service. To make the proxy server reachable from outside the victim’s network, the attackers could have used MythicRatatoskr’s expose command to expose it through the Yggdrasil network. Alternatively, they may have used another existing tunnel to access the machine. As stated in its FAQ, Yggdrasil is not anonymous, so it is possible to locate nodes in the Yggdrasil network. First, we tried to find the C&C server 201:b479:2771:8df4:b5eb:d007:63b0[:]2838, which we extracted from the MythicRatatoskr configuration, in the publicly available map of the Yggdrasil network at http://51.15.204.214/ to no avail because the map was last updated on August 8th, 2024, nearly a year before the intrusion took place. We therefore generated our own map of the network’s spanning tree, which does include the C&C server, as shown in Figure 1. The C&C server is situated near the center of the tree, making it easily reachable from other peers. The colors of each node indicate how far the node is from the C&C server. For example, as indicated by the red color, the connection from/to the nodes at the edge can be unreliable. The coordinates (Coords) for the C&C are rather simple: the server is reachable via the node with ID 4, which is the root of the spanning tree. Using Yggdrasil’s command line utility yggdrasilctl, we identified that the C&C server is configured with three public peers, shown in Figure 2. The C&C server’s port 443 uses TLS certificates that are rotated regularly. This pattern is characteristic of certificates generated by revsocks, on which the server code is probably based. Conclusion In this campaign, we observed cooperation, or at least operational handoff, between two Russia-aligned threat groups with different roles. UAC‑0099 appears to have gained initial access to a Ukrainian logistics company using its known tooling. That access was later used in activity culminating in a destructive Sandworm operation. In addition, we identified a new backdoor, MythicRatatoskr, which is attributed to either UAC‑0099 or Sandworm. The C&C server for this backdoor is hosted within the Yggdrasil mesh network, and the use of such infrastructure made determining the server’s physical location particularly challenging. The backdoor was probably used to deploy the SOCKS5 server to route connections through the compromised network. To our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor, and it may signal a broader trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure. Ultimately, Sandworm carried out a data-wiping attack by deploying the SDelete utility via Active Directory Group Policy, a technique consistent with previous Sandworm destructive operations. IoCs A comprehensive list of indicators of compromise (IoCs) and samples can be found in our GitHub repository. Files Network MITRE ATT&CK techniques This table was built using version 19 of the MITRE ATT&CK framework. tls://37.205.14[.]171:993 tls://109.176.250[.]101:65534 tls://65.21.57[.]122:61995 tls://95.217.35[.]92:1337 tls://51.255.223[.]60:54232 tls://51.15.204[.]214:54321 tls://s2.i2pd[.]xyz:39575 tls://62.210.85[.]80:39575 tls://vpn.ltha[.]de:443?key=0000006149970f245e6cec43664bce203f2514b60a153e194f31e2b229a1339d tls://mlupo.duckdns[.]org:9001 quic://ip6.fvm.mywire[.]org:443?key=000000000143db657d1d6f80b5066dd109a4cb31f7dc6cb5d56050fffb014217 tls://helium.avevad[.]com:1337 tls://yggdrasil.neilalexander[.]dev:64648?key=ecbbcb3298e7d3b4196103333c3e839cfe47a6ca47602b94a6d596683f6bb358 tls://bode.theender[.]net:42169?key=f91b909f43829f8b20732b3bcf80cbc4bb078dd47b41638379a078e35984c9a4 tls://g.ygg[.]yt:443 tls://b.ygg[.]yt:443 tls://n.ygg[.]yt:443 tls://ygg1.grin[.]hu:42444 tls://[2a03:90c0:85:[:]28a]:443 tls://srl.newsdeef[.]eu:59999 tls://23.137.249[.]65:444 tls://ygg-nl.incognet[.]io:8884 quic://0.ygg.l1qu1d[.]net:11102?key=0000000998b5ff8c0f1115ce9212f772d0427151f50fe858e6de1d22600f1680 tls://london.sabretruth[.]org:18472 tls://yggdrasil.sunsung[.]fun:4443 tls://78.27.153[.]163:33166 tls://193.93.119[.]42:443 tcp://sysop[.]link:555 tls://sto01.yggdrasil.hosted-by.skhron[.]eu:8884 tls://ygg.ace.ctrl-c.liu[.]se:9999?key=5636b3af4738c3998284c4805d91209cab38921159c66a6f359f3f692af1c908 quic://spain.magicum[.]net:36900 tcp://y.zbin[.]eu:7743
welivesecurity.comOct 22, 2026source