Russia-aligned hackers use Yggdrasil network in Ukrainian attack

ESET researchers have identified a coordinated cyberattack against a Ukrainian grain company involving the use of a previously unknown Go-based backdoor named MythicRatatoskr. The attack involved a handover between two Russia-aligned threat actors: UAC-0099, which gained initial access via phishing, and Sandworm, which is attributed to Russia’s GRU Unit 74455.

In a novel tactic, the attackers utilized the Yggdrasil mesh network to hide malware command-and-control traffic. Yggdrasil is a decentralized, encrypted network that allows devices to communicate directly without a central operator, making it difficult for security teams to disrupt the connection by shutting down a single server.

Following the initial intrusion in July 2025, the attackers deployed MythicRatatoskr to steal files and run commands. Two months later, in September 2025, Sandworm conducted a destructive data-wiping operation using SDelete to permanently erase files across the company’s systems.