Threats · 3h ago
ESET traced Sandworm’s September 17, 2025, data wipe at a Ukrainian logistics firm to access UAC-0099 gained on July 16—more than two months earlier.
UAC-0099 deployed MythicRatatoskr, a backdoor that routed its control traffic through Yggdrasil, a peer-to-peer mesh network, rather than a conventional fixed command server. ESET says access was handed to Sandworm, which delivered SDelete through Active Directory Group Policy to wipe data. ESET could not determine which actor primarily operated the backdoor.
For Ukrainian logistics networks, an intrusion treated as UAC-0099 espionage may not be contained if access persists and passes to a separate destructive operator. A wipe delivered through Group Policy can reach beyond the initially accessed Windows system, while ESET’s uncertainty about backdoor ownership leaves unclear who maintained the foothold before the attack.
2 sources covering this story
Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
Sandworm wiped a Ukrainian logistics firm in September 2025 after UAC-0099 gained access and deployed a new Yggdrasil-based backdoor.
The Record from Recorded Future
Russian hackers teamed up to wipe data at Ukrainian grain firm
The Russian state-linked hacking group Sandworm collaborated with another threat actor to carry out a destructive cyberattack against a Ukrainian grain logistics company last year, researchers said Thursday.
Part of the PlainSec briefing for 2026-10-23