> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # UAC-0099 hands off access to Sandworm using Yggdrasil mesh backdoor - URL: https://f4n6.co.uk/security-feed/uac-0099-hands-off-access-to-sandworm-using-yggdrasil-mesh-backdoor/ - Published: 2026-10-23T18:12:44.000Z - Updated: 2026-10-23T18:12:44.000Z - Author: Jeff Davies - Tags: #security-feed, UAC-0099, Sandworm, Gamaredon, Turla, InvisiMole ## 1\. Executive summary ESET documented an intrusion at a Ukrainian grain logistics company in which UAC-0099 gained initial access on 16 July 2025 through a spearphishing attachment, deployed the MATCHWOK backdoor and then a previously undocumented Go backdoor named MythicRatatoskr, and handed the access to Sandworm, which ran a data-wiping attack with SDelete pushed through Active Directory Group Policy on 17 September 2025\. MythicRatatoskr is notable for reaching its command-and-control server over the Yggdrasil mesh network, an encrypted IPv6 overlay that gives the operators a resilient, hard-to-disrupt channel and makes the server's physical location difficult to determine. No CVE is involved: the entry point is user execution of a malicious attachment, not a software flaw. The direct risk to EMEA financial services is low today because ESET reports no use of MythicRatatoskr outside this campaign and the targeting is Ukrainian, but the handoff pattern and the mesh-network C2 are techniques that will migrate. Sandworm (MITRE G0034) is a confirmed, tracked destructive actor; UAC-0099 has no MITRE ATT&CK profile, so its attribution rests on ESET's reporting alone and is treated as unconfirmed here. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 28 | The intrusion chain depends on third-party infrastructure the victim does not control: public Yggdrasil peers, an OpenSSH SFTP server used to push additional samples, and a C2 hosted inside a public mesh network. | ICT third-party risk assessment must cover not only contracted providers but the public peer and relay infrastructure an attacker can co-opt; egress policy and peer-blocking controls belong in the provider and network risk review. | | NIS2 Art. 21(2)(d) | The same supply-chain and third-party exposure: the attack used public mesh peers and an SFTP server as transport, and the destructive stage was delivered through Active Directory Group Policy, an internal administrative channel. | Supply chain security measures must extend to the integrity of internal administrative tooling (GPO) and to monitoring of outbound connections to peer-to-peer and mesh networks, not just to vendor software. | No DORA or NIS2 article on incident reporting is engaged by this item for an EMEA client, because the incident described occurred at a Ukrainian organisation and no EMEA client is named as affected. ## 3\. Technical analysis & attack chain Confirmed steps, from ESET telemetry: 1. 16 July 2025, 06:59: a scheduled task named `pdfopentask` ran on one machine and executed a PowerShell payload from `%temp%\temporarydoc.txt`. Initial access was a spearphishing email with a malicious attachment, consistent with CERT-UA's earlier reporting. 2. 16 July 2025, 07:00: the MATCHBOIL downloader was deployed. It fetched the MATCHWOK backdoor from `hxxps://egyptanimals[.]com/animals/photoalbum`; MATCHWOK's C2 is `hxxps://uztickets[.]com`. 3. 17 July 2025, 09:28: a new binary, the MythicRatatoskr backdoor, was delivered to the same machine. ESET assesses with high confidence that the MATCHWOK chain led to this deployment. 4. Additional MythicRatatoskr samples were pushed to other machines in the organisation using an OpenSSH SFTP server. 5. A SOCKS5 server was later found on some machines; one sample was extracted from an unknown archive with WinRAR. ESET believes MythicRatatoskr deployed it. 6. 17 September 2025: data-wiping activity. SDelete was deployed through Active Directory Group Policy, a Sandworm technique ESET has observed repeatedly. MythicRatatoskr is a Go backdoor. Function names left in the binaries mix camel case (`CheckInAgent`) and snake case (`agent_run`), covering service registration (`main`, `runService`), check-in and beaconing (`agent_run`, `init_agent`, `CheckInAgent`), configuration handling (`saveConfig`, `Encrypt`, `Decrypt`) and command dispatch (`getTasks`, `doTask`). Strings in the binaries suggest development began between December 2024 and February 2025\. Some samples include a 10-minute startup delay before connecting to the network. Persistence. MythicRatatoskr runs as a Windows service named `ieupdate`. Windows event logs from the compromised machines show `updater.exe` and `WindowsDefenderSvc.exe` started as services. MATCHBOIL persists MATCHWOK separately by writing the registry value `UpdateMonitor` under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\`, pointing at the dropped MATCHWOK path. Command and control. The backdoor joins the public Yggdrasil mesh network, an encrypted IPv6 overlay in which each node generates its own Ed25519 key pair and derives its IPv6 address from the public key in the `200::/7` range (deprecated by IETF in 2004). The code is based on the `yggstack` user-space network stack, so it needs no tunnel interface and no elevated privilege to create one. Each sample carries the same base64-encoded list of 32 public peers; the backdoor picks three at random and connects. It generates a fresh Ed25519 key on every run, so the victim's Yggdrasil address changes each time, and it sets `NodeInfoPrivacy` with empty NodeInfo so other nodes cannot read its version or OS. C2 traffic is HTTPS on port 443 to `[201:b479:2771:8df4:b5eb:d007:63b0:2838]`, using JSON HTTP POST messages of four types: `checkin` (registers the implant, sends username, hostname and local IPs, receives a fresh uuid and psk), `tasking` (polls for commands), `result` (returns output, base64-encoded where present) and `getfile` (retrieves file content for upload). The C2 server's TLS certificates rotate regularly, a pattern ESET says is characteristic of revsocks, on which the server code is probably based. Configuration. The backdoor-specific config is a JSON file at a hardcoded path, encrypted with AES-256-CFB under a hardcoded key embedded in the binary (`US3pM9KFxrZBSgc1pGl2wO4Kir1XjZP5Z9kBXBMYd2s=`, base64-decoded before use), with the first 16 bytes of the file as the IV. The file is not required to start: the malware carries an embedded default config, encrypts it and writes it to disk on first run, and operators can update it later by command. Embedded defaults include `sleep` 5m, `count` 5, a placeholder `uuid` of 123 (replaced by the server-issued UUID; a hardcoded `d71f1722-cf0b-4e27-9f8e-c95ec9b24a23` is used in the check-in message), and a `psk` field that matches the AES key but has no effect on encryption. A separate hardcoded proxy address `[201:b479:2771:8df4:b5eb:d007:63b0:2838]:8080` cannot be changed at runtime. Capabilities. Commands are hardcoded strings: `chtime` (change sleep), `expose` (forward TCP from the Yggdrasil network to a local port), `upload` (pull a file from C2 and write it to disk), `download` (send a local file to C2), `nodeinfo` (return the node's IPv6 address, subnet and public key), `screenshot` (capture all active displays, held only in the command result, not written to disk), `cd`, `ls`, `pwd`, `churl` (change the C2 URL), `proxy` (start/stop a reverse SOCKS5 proxy to the hardcoded address on port 8080; code largely copied from revsocks, with debug strings `Accepting stream` and `Passing off to socks5` and function `connectForSocks`), and `shell` (run a command via `cmd.exe`). On check-in it sends current user, hostname and local network settings. Operators can exfiltrate files and screenshots over HTTPS through the mesh; data is not staged before exfiltration. The standalone SOCKS5 server is a separate Go tool internally named `bindProxy`, built on `go-socks5`, listening on `127.0.0.1:33690` (local-only). ESET does not know why a separate tool was deployed when MythicRatatoskr already has proxy capability; one possibility is that the built-in `proxy` command did not work as expected. Together they give forward and reverse proxying. Host artefacts. Installation paths observed: `C:\windows\system32\updater.exe`, `C:\Windows\system32\krbtman.exe`, `C:\windows\system32\windowsdefendersvc.exe`, `%localappdata%\Microsoft\OneDrive\OneDriveLiveUpdater.exe`, `c:\program files (x86)\microsoft.net\adomd.net\110\applicationasphost.exe`, `C:\OFFICE2010\Utilities\Act64.exe`, `%userprofile%\Downloads\WindowsDefenderSvc.exe`, `%userprofile%\Downloads\ieupdate.exe`, `%userprofile%\Downloads\ie.exe`, `%userprofile%\AppData\Local\Internet Explorer\ieupdate.exe`, `%userprofile%\AppData\Local\ieupdate.exe`. Config paths: `C:\Windows\Temp\.updatecache`, `C:\Windows\system32\.updatecache`, `%LocalAppData%/Temp/.crond` (forward slashes are the attackers' typo). The `.crond` filename and the dot-prefix convention, which hides files on Unix-like systems but not on Windows, plus an unused `/tmp/.test_config` path in `OneDriveLiveUpdater.exe`, indicate a Linux variant may exist. `krbtman.exe` is a filename collision: it is MythicRatatoskr on some machines and the SOCKS5 server on others. SOCKS5 server paths: `C:\Windows\system32\krbtman.exe`, `%userprofile%\Downloads\krbtman.exe`, `%localappdata%\SMBCache\nbtresolver.exe`. Attribution and confidence. ESET attributes the post-compromise chain to UAC-0099 with high confidence, based on the MATCHBOIL and MATCHWOK tooling already tied to that group, and the wiping to Sandworm with high confidence, based on TTPs. ESET assesses with high confidence that UAC-0099 handed access to Sandworm but could not determine whether MythicRatatoskr was operated mainly by UAC-0099 or by Sandworm. This is single-sourced to ESET; the CERT-UA advisory corroborates the initial-access vector and the MATCHBOIL/MATCHWOK chain but not the handoff or the backdoor. UAC-0099 has no MITRE ATT&CK profile, so its attribution is unconfirmed in our tracking; Sandworm is tracked as G0034\. ESET's claim that this is the first documented state-aligned abuse of Yggdrasil is ESET's own assessment and is not independently corroborated. ## 4\. Mitigation & containment P1 within 24h - Hunt for the service name `ieupdate` and for the installation paths in §3, especially `updater.exe`, `windowsdefendersvc.exe`, `krbtman.exe` and `OneDriveLiveUpdater.exe` in `System32` and user profile directories. Any hit is a live implant: isolate the host. - Hunt for the config files `C:\Windows\Temp\.updatecache`, `C:\Windows\system32\.updatecache` and `%LocalAppData%\Temp\.crond`. Their presence indicates MythicRatatoskr execution even if the binary has been removed. - Block outbound connections to the 32 embedded Yggdrasil public peers listed in §5 at the egress firewall and proxy. ESET names this as a viable mitigation for the mesh C2\. Also block outbound to the `200::/7` IPv6 range at the perimeter if your estate has no legitimate use for it. - Block the C2 and staging domains and IPs in §5, and alert on any process making HTTPS POSTs to a bare IPv6 literal on port 443. - Check for the `UpdateMonitor` value under `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\` and for a scheduled task named `pdfopentask`. P2 within 72h - Alert on `cmd.exe` spawned by any of the installation-path binaries, and on `go-socks5`\-style listeners on `127.0.0.1:33690`. A local-only SOCKS5 listener on that port is a strong signal of the `bindProxy` tool. - Restrict and monitor Active Directory Group Policy changes. The destructive stage used GPO to push SDelete; alert on new or modified GPOs that deploy executables or scripts to many endpoints, and require change approval for GPO-linked binary delivery. - Review OpenSSH/SFTP server logs for unauthorised uploads of executables to internal hosts, since additional samples were pushed this way. - Block execution of `SDelete` (`sdelete.exe`, `sdelete64.exe`) outside approved administrative use, and alert on its invocation with wipe flags. P3 within 7 days - Add the YARA and Sigma rules in §6 to EDR and SIEM. - Restrict outbound access to peer-to-peer, mesh and overlay networks generally, not only Yggdrasil, and log any attempt to reach them. - Review egress for IPv6: many estates monitor IPv4 egress and not IPv6, and this C2 is IPv6-only inside the overlay. No vendor patch applies. There is no CVE and no fixed version; the entry point is a malicious attachment and the persistence is service and registry based. Remediation is detection, egress control and GPO integrity, not patching. ## 5\. Indicators of compromise All indicators below are from ESET's reporting and are single-sourced; verify before enforcing blocks on shared infrastructure such as the public Yggdrasil peers, several of which are legitimate community nodes. | type | value | confidence | source | | ------ | -------------------------------------------- | ---------- | ---------------------------- | | sha1 | d5f9288daebf87ae4579945f8dc6cf235b093cfd | high | ESET | | sha1 | b69ef0e45b401440c0fde22046775d0c57e87415 | high | ESET | | sha1 | 4e3e6577866e4ce2ed73ca089700ae04230e768f | high | ESET | | sha1 | 69969eeb7e0a3d84c4e70193636fcf934c6aa388 | high | ESET | | sha1 | 01855153ca7a33ad5ff36451de5612dfba0dd2ca | high | ESET | | sha1 | e29af83a07fb32eb47c28733a9382e766d53f704 | high | ESET | | sha1 | 028ca11f3f0d8396043af7bf756231fc2f50f829 | high | ESET | | sha1 | 9085896989947c0919a660352f75f6b233fc645b | high | ESET | | sha1 | d7e6a5a46c6ed3510997e91b11e51be0250fd2a2 | high | ESET | | sha1 | 131a371a1e4ee78ec3b2863607c99290ec3b58a6 | high | ESET | | sha1 | 09c816697c0c2aff9b4ff58681558ca30d04c9cd | high | ESET | | sha1 | 8ceb5f8bcdf4995b7164996f1629d682613bb17b | high | ESET | | ipv6 | 201:b479:2771:8df4:b5eb:d007:63b0:2838 | high | ESET | | domain | uztickets\[.\]com | high | ESET | | domain | egyptanimals\[.\]com | high | ESET | | domain | 37.205.14\[.\]171:993 | medium | ESET (public Yggdrasil peer) | | domain | 109.176.250\[.\]101:65534 | medium | ESET (public Yggdrasil peer) | | domain | 65.21.57\[.\]122:61995 | medium | ESET (public Yggdrasil peer) | | domain | 95.217.35\[.\]92:1337 | medium | ESET (public Yggdrasil peer) | | domain | 51.255.223\[.\]60:54232 | medium | ESET (public Yggdrasil peer) | | domain | 51.15.204\[.\]214:54321 | medium | ESET (public Yggdrasil peer) | | domain | s2.i2pd\[.\]xyz:39575 | medium | ESET (public Yggdrasil peer) | | domain | 62.210.85\[.\]80:39575 | medium | ESET (public Yggdrasil peer) | | domain | vpn.ltha\[.\]de:443 | medium | ESET (public Yggdrasil peer) | | domain | mlupo.duckdns\[.\]org:9001 | medium | ESET (public Yggdrasil peer) | | domain | ip6.fvm.mywire\[.\]org:443 | medium | ESET (public Yggdrasil peer) | | domain | helium.avevad\[.\]com:1337 | medium | ESET (public Yggdrasil peer) | | domain | yggdrasil.neilalexander\[.\]dev:64648 | medium | ESET (public Yggdrasil peer) | | domain | bode.theender\[.\]net:42169 | medium | ESET (public Yggdrasil peer) | | domain | g.ygg\[.\]yt:443 | medium | ESET (public Yggdrasil peer) | | domain | b.ygg\[.\]yt:443 | medium | ESET (public Yggdrasil peer) | | domain | n.ygg\[.\]yt:443 | medium | ESET (public Yggdrasil peer) | | domain | ygg1.grin\[.\]hu:42444 | medium | ESET (public Yggdrasil peer) | | ipv6 | 2a03:90c0:85:28a:443 | medium | ESET (public Yggdrasil peer) | | domain | srl.newsdeef\[.\]eu:59999 | medium | ESET (public Yggdrasil peer) | | domain | 23.137.249\[.\]65:444 | medium | ESET (public Yggdrasil peer) | | domain | ygg-nl.incognet\[.\]io:8884 | medium | ESET (public Yggdrasil peer) | | domain | 0.ygg.l1qu1d\[.\]net:11102 | medium | ESET (public Yggdrasil peer) | | domain | london.sabretruth\[.\]org:18472 | medium | ESET (public Yggdrasil peer) | | domain | yggdrasil.sunsung\[.\]fun:4443 | medium | ESET (public Yggdrasil peer) | | domain | 78.27.153\[.\]163:33166 | medium | ESET (public Yggdrasil peer) | | domain | 193.93.119\[.\]42:443 | medium | ESET (public Yggdrasil peer) | | domain | sysop\[.\]link:555 | medium | ESET (public Yggdrasil peer) | | domain | sto01.yggdrasil.hosted-by.skhron\[.\]eu:8884 | medium | ESET (public Yggdrasil peer) | | domain | ygg.ace.ctrl-c.liu\[.\]se:9999 | medium | ESET (public Yggdrasil peer) | | domain | spain.magicum\[.\]net:36900 | medium | ESET (public Yggdrasil peer) | | domain | y.zbin\[.\]eu:7743 | medium | ESET (public Yggdrasil peer) | ```iocs sha1 d5f9288daebf87ae4579945f8dc6cf235b093cfd sha1 b69ef0e45b401440c0fde22046775d0c57e87415 sha1 4e3e6577866e4ce2ed73ca089700ae04230e768f sha1 69969eeb7e0a3d84c4e70193636fcf934c6aa388 sha1 01855153ca7a33ad5ff36451de5612dfba0dd2ca sha1 e29af83a07fb32eb47c28733a9382e766d53f704 sha1 028ca11f3f0d8396043af7bf756231fc2f50f829 sha1 9085896989947c0919a660352f75f6b233fc645b sha1 d7e6a5a46c6ed3510997e91b11e51be0250fd2a2 sha1 131a371a1e4ee78ec3b2863607c99290ec3b58a6 sha1 09c816697c0c2aff9b4ff58681558ca30d04c9cd sha1 8ceb5f8bcdf4995b7164996f1629d682613bb17b ipv6 201:b479:2771:8df4:b5eb:d007:63b0:2838 domain uztickets[.]com domain egyptanimals[.]com domain 37.205.14[.]171:993 domain 109.176.250[.]101:65534 domain 65.21.57[.]122:61995 domain 95.217.35[.]92:1337 domain 51.255.223[.]60:54232 domain 51.15.204[.]214:54321 domain s2.i2pd[.]xyz:39575 domain 62.210.85[.]80:39575 domain vpn.ltha[.]de:443 domain mlupo.duckdns[.]org:9001 domain ip6.fvm.mywire[.]org:443 domain helium.avevad[.]com:1337 domain yggdrasil.neilalexander[.]dev:64648 domain bode.theender[.]net:42169 domain g.ygg[.]yt:443 domain b.ygg[.]yt:443 domain n.ygg[.]yt:443 domain ygg1.grin[.]hu:42444 ipv6 2a03:90c0:85:28a:443 domain srl.newsdeef[.]eu:59999 domain 23.137.249[.]65:444 domain ygg-nl.incognet[.]io:8884 domain 0.ygg.l1qu1d[.]net:11102 domain london.sabretruth[.]org:18472 domain yggdrasil.sunsung[.]fun:4443 domain 78.27.153[.]163:33166 domain 193.93.119[.]42:443 domain sysop[.]link:555 domain sto01.yggdrasil.hosted-by.skhron[.]eu:8884 domain ygg.ace.ctrl-c.liu[.]se:9999 domain spain.magicum[.]net:36900 domain y.zbin[.]eu:7743 ``` Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ---------- | | Windows service named ieupdate created and started | Windows System event log, service creation (Event ID 7045) | high | | updater.exe or WindowsDefenderSvc.exe started as a service | Windows System event log | high | | UpdateMonitor value written under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ | Registry, endpoint telemetry | high | | Scheduled task pdfopentask executing a PowerShell payload from %temp%\\temporarydoc.txt | Task Scheduler log, process creation | high | | Outbound HTTPS POST to a bare IPv6 literal on port 443 | Network flow, proxy logs | high | | Local-only SOCKS5 listener on 127.0.0.1:33690 | Endpoint network telemetry | high | | cmd.exe spawned by an installation-path binary | Process creation (parent-child) | high | | GPO-linked deployment of sdelete.exe or sdelete64.exe across endpoints | Group Policy change audit, process creation | high | | 10-minute delay between process start and first outbound connection | Network flow timing | medium | ## 6\. Detection ```yara rule MythicRatatoskr_Go_Backdoor { meta: author = "Adverse Trace" date = "2026-10-23" reference = "https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/" description = "Detects MythicRatatoskr Go backdoor by embedded config key, command strings and revsocks-derived proxy strings" strings: $key = "US3pM9KFxrZBSgc1pGl2wO4Kir1XjZP5Z9kBXBMYd2s=" ascii $uuid = "d71f1722-cf0b-4e27-9f8e-c95ec9b24a23" ascii $c2 = "201:b479:2771:8df4:b5eb:d007:63b0:2838" ascii $cmd1 = "screencat" ascii $cmd2 = "manageProxy" ascii $cmd3 = "nodeinfo" ascii $cmd4 = "churl" ascii $fn1 = "CheckInAgent" ascii $fn2 = "agent_run" ascii $fn3 = "init_agent" ascii $fn4 = "connectForSocks" ascii $dbg1 = "Accepting stream" ascii $dbg2 = "Passing off to socks5" ascii $cfg1 = ".updatecache" ascii $cfg2 = ".crond" ascii condition: uint16(0) == 0x5A4D and ( $key or $uuid or $c2 or 2 of ($cmd*) or 2 of ($fn*) or any of ($dbg*) or any of ($cfg*) ) } ``` ```yaml title: MythicRatatoskr service persistence and Yggdrasil C2 id: 8f3c2a10-ratatoskr-2026 status: experimental description: Detects creation of the ieupdate service and outbound HTTPS to a bare IPv6 literal consistent with MythicRatatoskr mesh C2 author: Adverse Trace date: 2026/10/23 references: - https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/ logsource: product: windows service: system detection: selection_service: EventID: 7045 ServiceName: 'ieupdate' selection_image: EventID: 7045 ImagePath|endswith: - '\updater.exe' - '\windowsdefendersvc.exe' - '\krbtman.exe' - '\OneDriveLiveUpdater.exe' condition: selection_service or selection_image falsepositives: - Legitimate software using the ieupdate service name (rare; verify image path) level: high --- title: MythicRatatoskr scheduled task and temp payload execution id: 2b7d4e11-ratatoskr-task-2026 status: experimental description: Detects the pdfopentask scheduled task executing a PowerShell payload from temporarydoc.txt author: Adverse Trace date: 2026/10/23 references: - https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/ logsource: product: windows category: process_creation detection: selection: CommandLine|contains|all: - 'temporarydoc.txt' - 'powershell' condition: selection falsepositives: - Unlikely level: high ``` ## Threat actor context **Sandworm Team** · [G0034](https://attack.mitre.org/groups/G0034?ref=f4n6.co.uk) · aka ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group), Quedagh [Sandworm Team](https://attack.mitre.org/groups/G0034?ref=f4n6.co.uk) is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455\. This group has been active since at least 2009\. … **Gamaredon Group** · [G0047](https://attack.mitre.org/groups/G0047?ref=f4n6.co.uk) · aka IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon, Shuckworm [Gamaredon Group](https://attack.mitre.org/groups/G0047?ref=f4n6.co.uk) is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013\. The name [Gamaredon Group](https://attack.mitre.org/groups/G0047?ref=f4n6.co.uk) derives from a misspelling of the word "Armageddon," found in early campaigns. … **Turla** · [G0010](https://attack.mitre.org/groups/G0010?ref=f4n6.co.uk) · aka IRON HUNTER, Group 88, Waterbug, WhiteBear, Snake [Turla](https://attack.mitre.org/groups/G0010?ref=f4n6.co.uk) is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. … *No MITRE ATT&CK profile for: UAC-0099, InvisiMole.* ## 7\. Sources - ESET (WeLiveSecurity), "MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration", https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/, 2026-10-22. - CERT-UA advisory on MATCHBOIL and MATCHWOK, referenced by ESET (URL not supplied in the source material; obtain from CERT-UA directly). ## 8\. Adverse Trace position Adverse Trace assesses this as a targeted destructive campaign against a Ukrainian logistics organisation, with no CVE, no confirmed EMEA victim and no evidence that MythicRatatoskr has been used outside this intrusion; the direct risk to EMEA financial services is low, and we do not inflate it. The material risk is the technique: a state-aligned actor using a public mesh network for resilient C2, and an initial-access group handing access to a destructive actor. Both the handoff and the backdoor analysis are single-sourced to ESET, and UAC-0099 has no MITRE ATT&CK profile, so we treat its attribution as unconfirmed while accepting Sandworm (G0034) as the destructive actor. We will add the Yggdrasil peer list and the C2 IPv6 to our block and hunt feeds, monitor for MythicRatatoskr or Yggdrasil use against EMEA clients, and re-issue this advisory if a second source corroborates the handoff or if the backdoor appears outside Ukraine. Clients should prioritise the P1 egress and host hunts in §4 this week; the GPO integrity control is the one that would have interrupted the destructive stage. --- [Read the original source →](https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*