UAC-0099 hands off access to Sandworm using Yggdrasil mesh backdoor

1. Executive summary

ESET documented an intrusion at a Ukrainian grain logistics company in which UAC-0099 gained initial access on 16 July 2025 through a spearphishing attachment, deployed the MATCHWOK backdoor and then a previously undocumented Go backdoor named MythicRatatoskr, and handed the access to Sandworm, which ran a data-wiping attack with SDelete pushed through Active Directory Group Policy on 17 September 2025. MythicRatatoskr is notable for reaching its command-and-control server over the Yggdrasil mesh network, an encrypted IPv6 overlay that gives the operators a resilient, hard-to-disrupt channel and makes the server's physical location difficult to determine. No CVE is involved: the entry point is user execution of a malicious attachment, not a software flaw. The direct risk to EMEA financial services is low today because ESET reports no use of MythicRatatoskr outside this campaign and the targeting is Ukrainian, but the handoff pattern and the mesh-network C2 are techniques that will migrate. Sandworm (MITRE G0034) is a confirmed, tracked destructive actor; UAC-0099 has no MITRE ATT&CK profile, so its attribution rests on ESET's reporting alone and is treated as unconfirmed here.

2. Regulatory framing

No DORA or NIS2 article on incident reporting is engaged by this item for an EMEA client, because the incident described occurred at a Ukrainian organisation and no EMEA client is named as affected.

3. Technical analysis & attack chain

Confirmed steps, from ESET telemetry:

1. 16 July 2025, 06:59: a scheduled task named pdfopentask ran on one machine and executed a PowerShell payload from %temp%\temporarydoc.txt. Initial access was a spearphishing email with a malicious attachment, consistent with CERT-UA's earlier reporting.
2. 16 July 2025, 07:00: the MATCHBOIL downloader was deployed. It fetched the MATCHWOK backdoor from hxxps://egyptanimals[.]com/animals/photoalbum; MATCHWOK's C2 is hxxps://uztickets[.]com.
3. 17 July 2025, 09:28: a new binary, the MythicRatatoskr backdoor, was delivered to the same machine. ESET assesses with high confidence that the MATCHWOK chain led to this deployment.
4. Additional MythicRatatoskr samples were pushed to other machines in the organisation using an OpenSSH SFTP server.
5. A SOCKS5 server was later found on some machines; one sample was extracted from an unknown archive with WinRAR. ESET believes MythicRatatoskr deployed it.
6. 17 September 2025: data-wiping activity. SDelete was deployed through Active Directory Group Policy, a Sandworm technique ESET has observed repeatedly.

MythicRatatoskr is a Go backdoor. Function names left in the binaries mix camel case (CheckInAgent) and snake case (agent_run), covering service registration (main, runService), check-in and beaconing (agent_run, init_agent, CheckInAgent), configuration handling (saveConfig, Encrypt, Decrypt) and command dispatch (getTasks, doTask). Strings in the binaries suggest development began between December 2024 and February 2025. Some samples include a 10-minute startup delay before connecting to the network.

Persistence. MythicRatatoskr runs as a Windows service named ieupdate. Windows event logs from the compromised machines show updater.exe and WindowsDefenderSvc.exe started as services. MATCHBOIL persists MATCHWOK separately by writing the registry value UpdateMonitor under HKCU\Software\Microsoft\Windows\CurrentVersion\Run\, pointing at the dropped MATCHWOK path.

Command and control. The backdoor joins the public Yggdrasil mesh network, an encrypted IPv6 overlay in which each node generates its own Ed25519 key pair and derives its IPv6 address from the public key in the 200::/7 range (deprecated by IETF in 2004). The code is based on the yggstack user-space network stack, so it needs no tunnel interface and no elevated privilege to create one. Each sample carries the same base64-encoded list of 32 public peers; the backdoor picks three at random and connects. It generates a fresh Ed25519 key on every run, so the victim's Yggdrasil address changes each time, and it sets NodeInfoPrivacy with empty NodeInfo so other nodes cannot read its version or OS. C2 traffic is HTTPS on port 443 to [201:b479:2771:8df4:b5eb:d007:63b0:2838], using JSON HTTP POST messages of four types: checkin (registers the implant, sends username, hostname and local IPs, receives a fresh uuid and psk), tasking (polls for commands), result (returns output, base64-encoded where present) and getfile (retrieves file content for upload). The C2 server's TLS certificates rotate regularly, a pattern ESET says is characteristic of revsocks, on which the server code is probably based.

Configuration. The backdoor-specific config is a JSON file at a hardcoded path, encrypted with AES-256-CFB under a hardcoded key embedded in the binary (US3pM9KFxrZBSgc1pGl2wO4Kir1XjZP5Z9kBXBMYd2s=, base64-decoded before use), with the first 16 bytes of the file as the IV. The file is not required to start: the malware carries an embedded default config, encrypts it and writes it to disk on first run, and operators can update it later by command. Embedded defaults include sleep 5m, count 5, a placeholder uuid of 123 (replaced by the server-issued UUID; a hardcoded d71f1722-cf0b-4e27-9f8e-c95ec9b24a23 is used in the check-in message), and a psk field that matches the AES key but has no effect on encryption. A separate hardcoded proxy address [201:b479:2771:8df4:b5eb:d007:63b0:2838]:8080 cannot be changed at runtime.

Capabilities. Commands are hardcoded strings: chtime (change sleep), expose (forward TCP from the Yggdrasil network to a local port), upload (pull a file from C2 and write it to disk), download (send a local file to C2), nodeinfo (return the node's IPv6 address, subnet and public key), screenshot (capture all active displays, held only in the command result, not written to disk), cd, ls, pwd, churl (change the C2 URL), proxy (start/stop a reverse SOCKS5 proxy to the hardcoded address on port 8080; code largely copied from revsocks, with debug strings Accepting stream and Passing off to socks5 and function connectForSocks), and shell (run a command via cmd.exe). On check-in it sends current user, hostname and local network settings. Operators can exfiltrate files and screenshots over HTTPS through the mesh; data is not staged before exfiltration.

The standalone SOCKS5 server is a separate Go tool internally named bindProxy, built on go-socks5, listening on 127.0.0.1:33690 (local-only). ESET does not know why a separate tool was deployed when MythicRatatoskr already has proxy capability; one possibility is that the built-in proxy command did not work as expected. Together they give forward and reverse proxying.

Host artefacts. Installation paths observed: C:\windows\system32\updater.exe, C:\Windows\system32\krbtman.exe, C:\windows\system32\windowsdefendersvc.exe, %localappdata%\Microsoft\OneDrive\OneDriveLiveUpdater.exe, c:\program files (x86)\microsoft.net\adomd.net\110\applicationasphost.exe, C:\OFFICE2010\Utilities\Act64.exe, %userprofile%\Downloads\WindowsDefenderSvc.exe, %userprofile%\Downloads\ieupdate.exe, %userprofile%\Downloads\ie.exe, %userprofile%\AppData\Local\Internet Explorer\ieupdate.exe, %userprofile%\AppData\Local\ieupdate.exe. Config paths: C:\Windows\Temp\.updatecache, C:\Windows\system32\.updatecache, %LocalAppData%/Temp/.crond (forward slashes are the attackers' typo). The .crond filename and the dot-prefix convention, which hides files on Unix-like systems but not on Windows, plus an unused /tmp/.test_config path in OneDriveLiveUpdater.exe, indicate a Linux variant may exist. krbtman.exe is a filename collision: it is MythicRatatoskr on some machines and the SOCKS5 server on others. SOCKS5 server paths: C:\Windows\system32\krbtman.exe, %userprofile%\Downloads\krbtman.exe, %localappdata%\SMBCache\nbtresolver.exe.

Attribution and confidence. ESET attributes the post-compromise chain to UAC-0099 with high confidence, based on the MATCHBOIL and MATCHWOK tooling already tied to that group, and the wiping to Sandworm with high confidence, based on TTPs. ESET assesses with high confidence that UAC-0099 handed access to Sandworm but could not determine whether MythicRatatoskr was operated mainly by UAC-0099 or by Sandworm. This is single-sourced to ESET; the CERT-UA advisory corroborates the initial-access vector and the MATCHBOIL/MATCHWOK chain but not the handoff or the backdoor. UAC-0099 has no MITRE ATT&CK profile, so its attribution is unconfirmed in our tracking; Sandworm is tracked as G0034. ESET's claim that this is the first documented state-aligned abuse of Yggdrasil is ESET's own assessment and is not independently corroborated.

4. Mitigation & containment

P1 within 24h

• Hunt for the service name ieupdate and for the installation paths in §3, especially updater.exe, windowsdefendersvc.exe, krbtman.exe and OneDriveLiveUpdater.exe in System32 and user profile directories. Any hit is a live implant: isolate the host.
• Hunt for the config files C:\Windows\Temp\.updatecache, C:\Windows\system32\.updatecache and %LocalAppData%\Temp\.crond. Their presence indicates MythicRatatoskr execution even if the binary has been removed.
• Block outbound connections to the 32 embedded Yggdrasil public peers listed in §5 at the egress firewall and proxy. ESET names this as a viable mitigation for the mesh C2. Also block outbound to the 200::/7 IPv6 range at the perimeter if your estate has no legitimate use for it.
• Block the C2 and staging domains and IPs in §5, and alert on any process making HTTPS POSTs to a bare IPv6 literal on port 443.
• Check for the UpdateMonitor value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ and for a scheduled task named pdfopentask.

P2 within 72h

• Alert on cmd.exe spawned by any of the installation-path binaries, and on go-socks5-style listeners on 127.0.0.1:33690. A local-only SOCKS5 listener on that port is a strong signal of the bindProxy tool.
• Restrict and monitor Active Directory Group Policy changes. The destructive stage used GPO to push SDelete; alert on new or modified GPOs that deploy executables or scripts to many endpoints, and require change approval for GPO-linked binary delivery.
• Review OpenSSH/SFTP server logs for unauthorised uploads of executables to internal hosts, since additional samples were pushed this way.
• Block execution of SDelete (sdelete.exe, sdelete64.exe) outside approved administrative use, and alert on its invocation with wipe flags.

P3 within 7 days

• Add the YARA and Sigma rules in §6 to EDR and SIEM.
• Restrict outbound access to peer-to-peer, mesh and overlay networks generally, not only Yggdrasil, and log any attempt to reach them.
• Review egress for IPv6: many estates monitor IPv4 egress and not IPv6, and this C2 is IPv6-only inside the overlay.

No vendor patch applies. There is no CVE and no fixed version; the entry point is a malicious attachment and the persistence is service and registry based. Remediation is detection, egress control and GPO integrity, not patching.

5. Indicators of compromise

All indicators below are from ESET's reporting and are single-sourced; verify before enforcing blocks on shared infrastructure such as the public Yggdrasil peers, several of which are legitimate community nodes.

sha1  d5f9288daebf87ae4579945f8dc6cf235b093cfd
sha1  b69ef0e45b401440c0fde22046775d0c57e87415
sha1  4e3e6577866e4ce2ed73ca089700ae04230e768f
sha1  69969eeb7e0a3d84c4e70193636fcf934c6aa388
sha1  01855153ca7a33ad5ff36451de5612dfba0dd2ca
sha1  e29af83a07fb32eb47c28733a9382e766d53f704
sha1  028ca11f3f0d8396043af7bf756231fc2f50f829
sha1  9085896989947c0919a660352f75f6b233fc645b
sha1  d7e6a5a46c6ed3510997e91b11e51be0250fd2a2
sha1  131a371a1e4ee78ec3b2863607c99290ec3b58a6
sha1  09c816697c0c2aff9b4ff58681558ca30d04c9cd
sha1  8ceb5f8bcdf4995b7164996f1629d682613bb17b
ipv6  201:b479:2771:8df4:b5eb:d007:63b0:2838
domain  uztickets[.]com
domain  egyptanimals[.]com
domain  37.205.14[.]171:993
domain  109.176.250[.]101:65534
domain  65.21.57[.]122:61995
domain  95.217.35[.]92:1337
domain  51.255.223[.]60:54232
domain  51.15.204[.]214:54321
domain  s2.i2pd[.]xyz:39575
domain  62.210.85[.]80:39575
domain  vpn.ltha[.]de:443
domain  mlupo.duckdns[.]org:9001
domain  ip6.fvm.mywire[.]org:443
domain  helium.avevad[.]com:1337
domain  yggdrasil.neilalexander[.]dev:64648
domain  bode.theender[.]net:42169
domain  g.ygg[.]yt:443
domain  b.ygg[.]yt:443
domain  n.ygg[.]yt:443
domain  ygg1.grin[.]hu:42444
ipv6  2a03:90c0:85:28a:443
domain  srl.newsdeef[.]eu:59999
domain  23.137.249[.]65:444
domain  ygg-nl.incognet[.]io:8884
domain  0.ygg.l1qu1d[.]net:11102
domain  london.sabretruth[.]org:18472
domain  yggdrasil.sunsung[.]fun:4443
domain  78.27.153[.]163:33166
domain  193.93.119[.]42:443
domain  sysop[.]link:555
domain  sto01.yggdrasil.hosted-by.skhron[.]eu:8884
domain  ygg.ace.ctrl-c.liu[.]se:9999
domain  spain.magicum[.]net:36900
domain  y.zbin[.]eu:7743

Behavioural indicators

6. Detection

rule MythicRatatoskr_Go_Backdoor
{
    meta:
        author = "Adverse Trace"
        date = "2026-10-23"
        reference = "https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/"
        description = "Detects MythicRatatoskr Go backdoor by embedded config key, command strings and revsocks-derived proxy strings"
    strings:
        $key = "US3pM9KFxrZBSgc1pGl2wO4Kir1XjZP5Z9kBXBMYd2s=" ascii
        $uuid = "d71f1722-cf0b-4e27-9f8e-c95ec9b24a23" ascii
        $c2 = "201:b479:2771:8df4:b5eb:d007:63b0:2838" ascii
        $cmd1 = "screencat" ascii
        $cmd2 = "manageProxy" ascii
        $cmd3 = "nodeinfo" ascii
        $cmd4 = "churl" ascii
        $fn1 = "CheckInAgent" ascii
        $fn2 = "agent_run" ascii
        $fn3 = "init_agent" ascii
        $fn4 = "connectForSocks" ascii
        $dbg1 = "Accepting stream" ascii
        $dbg2 = "Passing off to socks5" ascii
        $cfg1 = ".updatecache" ascii
        $cfg2 = ".crond" ascii
    condition:
        uint16(0) == 0x5A4D and
        (
            $key or $uuid or $c2 or
            2 of ($cmd*) or
            2 of ($fn*) or
            any of ($dbg*) or
            any of ($cfg*)
        )
}

title: MythicRatatoskr service persistence and Yggdrasil C2
id: 8f3c2a10-ratatoskr-2026
status: experimental
description: Detects creation of the ieupdate service and outbound HTTPS to a bare IPv6 literal consistent with MythicRatatoskr mesh C2
author: Adverse Trace
date: 2026/10/23
references:

  - https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/
logsource:
  product: windows
  service: system
detection:
  selection_service:
    EventID: 7045
    ServiceName: 'ieupdate'
  selection_image:
    EventID: 7045
    ImagePath|endswith:

      - '\updater.exe'
      - '\windowsdefendersvc.exe'
      - '\krbtman.exe'
      - '\OneDriveLiveUpdater.exe'
  condition: selection_service or selection_image
falsepositives:

  - Legitimate software using the ieupdate service name (rare; verify image path)
level: high
---
title: MythicRatatoskr scheduled task and temp payload execution
id: 2b7d4e11-ratatoskr-task-2026
status: experimental
description: Detects the pdfopentask scheduled task executing a PowerShell payload from temporarydoc.txt
author: Adverse Trace
date: 2026/10/23
references:

  - https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/
logsource:
  product: windows
  category: process_creation
detection:
  selection:
    CommandLine|contains|all:

      - 'temporarydoc.txt'
      - 'powershell'
  condition: selection
falsepositives:

  - Unlikely
level: high

Threat actor context

Sandworm Team · G0034 · aka ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group), Quedagh

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455. This group has been active since at least 2009. …

Gamaredon Group · G0047 · aka IRON TILDEN, Primitive Bear, ACTINIUM, Armageddon, Shuckworm

Gamaredon Group is a suspected Russian cyber espionage group that has targeted military, law enforcement, judiciary, non-profit, and non-governmental organizations in Ukraine since at least 2013. The name Gamaredon Group derives from a misspelling of the word "Armageddon," found in early campaigns. …

Turla · G0010 · aka IRON HUNTER, Group 88, Waterbug, WhiteBear, Snake

Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. …

No MITRE ATT&CK profile for: UAC-0099, InvisiMole.

7. Sources

• ESET (WeLiveSecurity), "MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration", https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/, 2026-10-22.
• CERT-UA advisory on MATCHBOIL and MATCHWOK, referenced by ESET (URL not supplied in the source material; obtain from CERT-UA directly).

8. Adverse Trace position

Adverse Trace assesses this as a targeted destructive campaign against a Ukrainian logistics organisation, with no CVE, no confirmed EMEA victim and no evidence that MythicRatatoskr has been used outside this intrusion; the direct risk to EMEA financial services is low, and we do not inflate it. The material risk is the technique: a state-aligned actor using a public mesh network for resilient C2, and an initial-access group handing access to a destructive actor. Both the handoff and the backdoor analysis are single-sourced to ESET, and UAC-0099 has no MITRE ATT&CK profile, so we treat its attribution as unconfirmed while accepting Sandworm (G0034) as the destructive actor. We will add the Yggdrasil peer list and the C2 IPv6 to our block and hunt feeds, monitor for MythicRatatoskr or Yggdrasil use against EMEA clients, and re-issue this advisory if a second source corroborates the handoff or if the backdoor appears outside Ukraine. Clients should prioritise the P1 egress and host hunts in §4 this week; the GPO integrity control is the one that would have interrupted the destructive stage.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.