Russian Sandworm and UAC-0099 deploy MythicRatatoskr Yggdrasil mesh backdoor before destructive wipe

State actors coordinate 63-day intrusion deploying userspace mesh backdoor before GPO wiping

Across a 63-day operational window between 16 July and 17 September 2025 (9.0 weeks, derived), two Russian state-aligned threat actors executed a coordinated cyber warfare assault against a Ukrainian grain logistics enterprise. Threat intelligence published by ESET reveals that Russian cyberespionage group UAC-0099 (also tracked as Earth Sirrush) secured initial entry via spear-phishing, delivering the MATCHBOIL downloader and MATCHWOK backdoor, before deploying an undocumented Go implant named MythicRatatoskr. In a technical first, MythicRatatoskr routed command-and-control (C2) over the decentralized Yggdrasil mesh network, marking the first confirmed instance of a nation-state advanced persistent threat (APT) utilizing a decentralized peer-to-peer overlay to shield operational infrastructure.

Following two months of clandestine reconnaissance targeting wartime maritime export corridors, UAC-0099 transferred administrative access to Sandworm (GRU Unit 74455), the Russian military intelligence service's premier cyber sabotage unit. On 17 September 2025, Sandworm initiated a catastrophic data destruction phase. Rather than compiling bespoke binary wipers, Sandworm weaponized Microsoft Sysinternals SDelete, orchestrating an enterprise-wide living-off-the-land file shredding assault distributed via Active Directory Group Policy (GPO) to permanently obliterate shipping databases, logistics manifests, and financial records.

Audit of verified technical telemetry versus operational assumptions

To evaluate the strategic implications of peer-to-peer mesh command-and-control and coordinated state sabotage, engineering teams must separate verified forensic telemetry from operational assumptions.

Audit of verified forensic disclosures for the Sandworm and UAC-0099 Ukrainian intrusion versus operational assumptions

Intrusion Dimension	Explicitly Verified in ESET Research Telemetry	Unverified or Dependent on Network Environment
Initial Access Chain	Scheduled task pdfopentask executing temporarydoc.txt (06:59, 16 July 2025), dropping MATCHBOIL and MATCHWOK.	The specific email gateway appliance or defensive filtering tier bypassed by the initial lure.
Lateral Movement	Attackers deployed additional MythicRatatoskr binaries to internal hosts using an OpenSSH SFTP server.	Whether threat actors harvested plaintext credentials from memory or abused pass-the-hash techniques.
Mesh C2 Implementation	Go backdoor leveraging yggstack for userspace IPv6 networking; C2 located at [201:b479:2771:8df4:b5eb:d007:63b0[:]2838].	The physical hosting jurisdiction or upstream internet service provider supporting the C2 node.
Backdoor Commands	11 native command primitives including expose (port forward), proxy (reverse SOCKS5), and in-memory screenshot.	The total quantity of maritime grain shipping contracts and port telemetry exfiltrated during the 63-day dwell.
Configuration Security	Disk configuration stored as .updatecache encrypted via AES-256-CFB using a hardcoded base64 key.	Whether a dedicated Linux variant of MythicRatatoskr was deployed concurrently on non-Windows servers.
Wiping Orchestration	Sandworm distributed Microsoft Sysinternals SDelete across all domain endpoints using Active Directory GPO.	The precise proportion of shredded databases successfully reconstructed from isolated offline backups.

The friendly-name fallacy: why kernel driver visibility fails against userspace mesh C2

The architecture of MythicRatatoskr overturns a pervasive friendly-name fallacy in endpoint security monitoring: the assumption that peer-to-peer overlay tunnels and VPNs inherently require administrative privileges to install virtual kernel network adapters (such as TUN/TAP drivers). Modern Endpoint Detection and Response (EDR) platforms frequently monitor driver loading events (Sysmon Event ID 6) to detect unauthorized tunnel software. MythicRatatoskr sidesteps this entire detection model by embedding yggstack, a specialized Go library that executes the entire Yggdrasil network stack inside the application user space. The malware communicates over raw TCP/IP without creating a virtual adapter, allowing unprivileged processes to join an encrypted IPv6 mesh completely undetected by driver-monitoring heuristics.

Upon initialization, MythicRatatoskr generates a fresh Ed25519 key pair, deriving an ephemeral IPv6 address within the 200::/7 subnet range. To establish connectivity, the binary contains an embedded, base64-encoded inventory of 32 public Yggdrasil peers, randomly selecting three operational peers to join the global public mesh. Crucially, the authors configured the malware with empty NodeInfo metadata and enabled the NodeInfoPrivacy flag, preventing public network crawlers and network topology scanners from indexing the infected endpoint's operating system or version. C2 communications are carried over HTTPS on port 443 to [201:b479:2771:8df4:b5eb:d007:63b0[:]2838], utilizing rotating TLS certificates generated by the open-source revsocks framework.

Zoom

Forensic analysis of MythicRatatoskr revealed an advanced 11-command backdoor capability. The implant supports native shell execution via cmd.exe, directory navigation (cd, ls, pwd), beacon timing adjustment (chtime), C2 URL reconfiguration (churl), and bidirectional file transfer (upload, download). For surveillance, the screenshot command captures framebuffers across all active displays in memory, returning base64-encoded image payloads directly within HTTP POST response structures without touching the local disk. To facilitate interactive lateral pivoting, the backdoor implements an expose command that forwards arbitrary TCP ports from the Yggdrasil mesh to local endpoints, alongside a proxy command that initiates a reverse SOCKS5 tunnel on port 8080. On several hosts, the attackers deployed a companion Go tool named bindProxy (masquerading as krbtman.exe or nbtresolver.exe) listening on 127.0.0.1:33690, exposing it through the mesh to establish dual-direction proxy tunnels.

Evidence embedded within the binaries strongly points to a multi-platform development pipeline. While the analyzed samples targeted Windows endpoints (persisting as Windows services named ieupdate and windowsdefendersvc.exe), multiple samples contained configuration paths with Unix conventions, such as %LocalAppData%/Temp/.crond and an unused test path /tmp/.test_config. Furthermore, all configuration filenames begin with a leading period (.updatecache), a convention designed to conceal files on Unix-like operating systems. The on-disk configuration is encrypted with AES-256-CFB using the hardcoded key US3pM9KFxrZBSgc1pGl2wO4Kir1XjZP5Z9kBXBMYd2s=, establishing a resilient configuration framework across potential Windows and Linux targets.

Inter-agency Russian intelligence collaboration: the hand-off doctrine

The transfer of access from UAC-0099 to Sandworm reflects an established operational doctrine among Russian state-aligned threat actors. ESET researchers previously documented collaborative campaigns linking FSB-aligned Gamaredon with Turla, as well as joint operations involving Gamaredon and InvisiMole. In this operational model, specialized initial access brokers and cyberespionage units maintain long-term footholds, siphoning tactical intelligence until strategic objectives dictate military sabotage.

At the 63-day mark, Sandworm operationalized this access to execute a kinetic-equivalent economic disruption. By distributing Microsoft Sysinternals SDelete via Active Directory Group Policy Objects, Sandworm ensured that every domain-joined server, workstation, and storage node received simultaneous wiping instructions upon the next Group Policy refresh cycle. Because SDelete is a trusted, digitally signed Microsoft administrative binary that implements Department of Defense disk-clearing routines, antivirus heuristics and file integrity monitors treated the mass overwrites as legitimate system maintenance, destroying critical logistics records before security teams could sever the mesh.

Detection engineering: neutralizing userspace mesh overlays and GPO wiping

Countering userspace mesh overlays and living-off-the-land wiping requires specialized detection logic focused on process execution arguments, public peer IP filtering, and Group Policy modification audits:

# Sigma Rule: Detect Sysinternals SDelete Deployed via Group Policy or Mass Execution
title: Suspicious SDelete Execution with Destructive Recursive Arguments
id: 9a3c8e41-628d-4f10-9b44-8d77c191a240
status: stable
description: Detects automated invocation of Microsoft Sysinternals SDelete with recursive shredding switches
logsource:
  category: process_creation
  product: windows
detection:
  selection_binary:
    Image|endswith:
      - '\sdelete.exe'
      - '\sdelete64.exe'
      - '\updater.exe'
      - '\krbtman.exe'
  selection_switches:
    CommandLine|contains:
      - ' -p '
      - ' -s '
      - ' -q '
      - ' -z '
      - ' -nobanner'
  condition: selection_binary and selection_switches
falsepositives:
  - Documented enterprise hardware decommissioning scripts executed by Domain Admins
level: high

At the network boundary, security operations centers must monitor outbound connections to documented Yggdrasil public peer nodes and block traffic on common mesh peering ports, including TCP and UDP 9001. Endpoint telemetry should actively alert on non-interactive processes writing dot-prefixed cache files (.updatecache, .crond) in %Temp% or %System32%, as well as unsigned processes binding to localhost loopback ports (such as 127.0.0.1:33690).

UK regulatory governance and critical supply chain resilience obligations

For UK critical national infrastructure operators, maritime shipping authorities, and logistics networks, the Sandworm and UAC-0099 campaign demonstrates how hostile state cyber warfare directly targets supply chain continuity. Under the UK Security of Network and Information Systems (NIS) Regulations 2018, operators of essential services in transport, maritime freight, and food distribution are legally mandated to implement technical defenses that prevent catastrophic operational disruption.

The UK National Cyber Security Centre (NCSC) guidance on nation-state cyber operations emphasizes that organizations must prepare for destructive attacks that deploy living-off-the-land administrative tools to defeat backup repositories. Under NCSC Cloud Security Principles and Ransomware Resilience standards, operators must maintain immutable, offline, write-once-read-many (WORM) storage environments that cannot be modified or purged via Active Directory administrative credentials.

Furthermore, under the UK Data Protection Act 2018 and UK GDPR Article 32, data controllers bear an affirmative legal obligation to guarantee the ongoing availability and resilience of processing systems. A destructive wipe that destroys personal data and commercial transport tracking records constitutes a serious breach of availability under Article 33, requiring notification to the Information Commissioner's Office (ICO) within 72 hours of detection.

Defender checklist: mitigating userspace mesh C2 and GPO wiping

The exposing question

When a nation-state adversary runs an encrypted, peer-to-peer IPv6 mesh network entirely in userspace without loading a single virtual driver, does your security operations center possess the network egress telemetry to detect the beaconing before they distribute a signed administrative tool via Active Directory to wipe your entire enterprise storage?

Key facts