MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC‑0099-Sandworm collaboration
Executive summary
This report analyzes activity during which UAC‑0099 gained initial access on July 16th, 2025 and handed it off to Sandworm, which then conducted a data-wiping attack on September 17th, 2025. It particularly focuses on the MythicRatatoskr backdoor, which is unique in its use of the Yggdrasil mesh network to communicate with a C&C server hosted within it.
We presented our findings about MythicRatatoskr at LABScon on September 18th, 2026, and at the Virus Bulletin conference on October 16th, 2026.
Key points of this blogpost:On July 16th, 2025, UAC-0099 gained initial access to a grain logistics company in Ukraine via a spearphishing email with a malicious attachment, leading to the execution chain of the MATCHWOK backdoor.One day later, the attackers deployed MythicRatatoskr, a previously undocumented backdoor that communicates with a C&C server hosted inside the Yggdrasil mesh network. We have not seen the backdoor used anywhere else,...
Copyright of this story solely belongs to www.welivesecurity.com. To see the full text click HERE
