MEDIUMVulnerability
Global

MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration

·Source: WeLiveSecurity (ESET)

Updated:

Executive Summary

ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm

Analysis

ESET researchers uncover MythicRatatoskr – a previously unknown Go-based backdoor hiding its C&C server inside the Yggdrasil mesh network – that paved the way for a destructive attack against a Ukrainian grain firm
Source Attribution

Originally published by WeLiveSecurity (ESET) on Oct 22, 2026.

Related Threats

MEDIUMApt

Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of

The Hacker News
MEDIUMApt

Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of

The Hacker News
MEDIUMVulnerability

Russian hackers teamed up to wipe data at Ukrainian grain firm

The Russian state-linked hacking group Sandworm collaborated with another threat actor to carry out a destructive cyberattack against a Ukrainian grain logistics company last year, researchers said Thursday.

The Record