Cybersecurity
Sandworm and UAC-0099 tied to Ukraine wiping attack
ESET said UAC-0099 gained access to a Ukrainian logistics company in July 2025, deployed a new backdoor over the Yggdrasil mesh network, and later handed the target to Sandworm for wiping.
- ESET said UAC-0099 got into the logistics company on 16 July 2025 through a spear-phishing email with a malicious attachment.
- ESET said MATCHBOIL delivered MATCHWOK, and that UAC-0099 deployed MythicRatatoskr a day later.
- ESET said MythicRatatoskr used Yggdrasil for command and control and could collect data, run commands, move files and take screenshots.
- ESET said Sandworm later wiped the target on 17 September 2025 by distributing SDelete through Active Directory Group Policy.
- ESET researchers Anton Cherepanov and Peter Strýček said the Yggdrasil abuse was the first documented case by a state-aligned actor and might indicate wider use of peer-to-peer networks.
ESET said UAC-0099 gained initial access to a Ukrainian logistics company on 16 July 2025 after a spear-phishing email delivered a malicious attachment. It said the attachment led to MATCHWOK being installed through a downloader called MATCHBOIL.
A day later, the group deployed MythicRatatoskr, which had not been documented before. ESET said the backdoor used a server inside the Yggdrasil mesh network for command traffic and could collect metadata, transfer files, take screenshots and run commands.
Sandworm later received the access and carried out the wiping stage on 17 September 2025. ESET said it pushed SDelete through Active Directory Group Policy, and noted that NikoWiper was also derived from SDelete.
ESET researchers Anton Cherepanov and Peter Strýček said the Yggdrasil abuse was the first documented case involving a state-aligned actor and could point to wider use of experimental peer-to-peer networks. ESET also said it had previously seen UAC-0099 pass validated targets to Sandworm, and had linked Gamaredon and Turla in earlier operations.
Named in this story
People
- Anton Cherepanov
- said the Yggdrasil abuse was the first documented case
- Peter Strýček
- joined ESET's statement on the Yggdrasil abuse
Companies
- ESET
- analysed the intrusion and published the assessment
Organisations
- Sandworm
- carried out the wiping attack
- UAC-0099
- gained initial access and handed over the target
- Gamaredon
- a Russia-linked group cited in a separate cooperation example
- Turla
- the other group in that earlier cooperation example
Products and systems
- MythicRatatoskr
- the previously undocumented backdoor used in the intrusion
- MATCHWOK
- the backdoor deployed before the hand-off to Sandworm
- MATCHBOIL
- the downloader that installed MATCHWOK
- Yggdrasil
- the mesh network used for command and control
- SDelete
- the utility used in the wiping stage
- NikoWiper
- the Sandworm-linked malware compared with SDelete
- PteroGraphin
- the Gamaredon tool used in the earlier example
- Kazuar
- the Turla backdoor deployed in the earlier example
- Pterodo
- the Gamaredon-linked downloader used to fetch InvisiMole
- InvisiMole
- the spyware referred to in the earlier example
- Active Directory Group Policy
- the mechanism used to push SDelete
Places
- Ukraine
- the country targeted in the attacks
How the source tells it
The article was mostly a technical incident report, with a light novelty frame around the backdoor and a cautious suggestion of a broader trend.
- novelty the piece singled out the case as the first documented abuse of Yggdrasil by a state-aligned actor
- speculative framing it suggested the incident may point to wider use of experimental peer-to-peer networks