ESET (22 Oct): previously unknown MythicRatatoskr backdoor hid its C&C server inside the Yggdrasil mesh network at a Ukrainian grain logistics company, where ESET says UAC-0099 gained access in July 2025 and handed it to Sandworm, which wiped data in September 2025
ESET researchers Anton Cherepanov and Peter Strýček published research on 22 October 2026 on MythicRatatoskr, a previously unknown Go-based backdoor that reaches a command-and-control server hosted inside Yggdrasil, a decentralised, experimental IPv6 mesh network. According to ESET, UAC-0099 gained initial access to a grain logistics company in Ukraine on 16 July 2025 through a spearphishing email with a malicious attachment that led to its MATCHBOIL downloader and MATCHWOK backdoor; the next day MythicRatatoskr was deployed, and ESET believes it was later used to deliver a SOCKS5 server. ESET says data-wiping activity followed on 17 September 2025, carried out by deploying the SDelete utility through Active Directory Group Policy, which it calls standard Sandworm tactics. ESET attributes the initial stage to UAC-0099 and the wiping to Sandworm with high confidence and assesses with high confidence that UAC-0099 handed off access to Sandworm, but says it cannot yet tell which group operated MythicRatatoskr. ESET says it has not seen the backdoor anywhere else, found indications that a Linux variant may exist, and notes Yggdrasil is not designed to provide anonymity; it says blocking the public peer addresses is a viable mitigation. ESET presented the findings at LABScon on 18 September 2026 and Virus Bulletin on 16 October 2026. According to Reuters (as published by iTnews on 23 October), ESET said it had not previously observed state-linked attacks using the network and could not confirm whether the attack disrupted grain operations, and a Microsoft spokesperson said SDelete is a legitimate administrative utility that can be misused by attackers who already have access. Source: ESET WeLiveSecurity (22 Oct 2026); wire: Reuters via iTnews (23 Oct).
- Product
- Windows hosts (Go-based MythicRatatoskr backdoor; possible Linux variant per ESET); Yggdrasil mesh network used for C&C
- Versions
- n/a — campaign / malware family (intrusion 16 July 2025, data wiping 17 September 2025)
- Exploited in Australia?
- unknown
- Patch to
- Block or alert on outbound connections to public Yggdrasil peers (ESET lists the 32 hard-coded peers) and on traffic in the 200::/7 range; hunt for a Windows service named ieupdate and .updatecache configuration files under C:\Windows\Temp or C:\Windows\system32; alert on Group Policy objects that push SDelete or other wiping tools. Full hashes, paths and network indicators are in ESET's report.
Primary: ESET WeLiveSecurity — MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration (22 Oct 2026) · Vendor: ESET Research (primary research, with IoCs and Yggdrasil peer list) · iTnews (Reuters) — Russia-linked hackers use decentralised network in Ukraine cyberattack (23 Oct 2026)