ESET says Russia-aligned UAC-0099 got into a Ukrainian grain logistics company on July 16, 2025 with a spearphishing attachment that led to its MATCHBOIL downloader and MATCHWOK backdoor. A day later it dropped MythicRatatoskr, a previously unknown Go backdoor (command execution, file transfer, screenshots, proxying, probably a SOCKS5 relay) whose C2 sits inside the Yggdrasil encrypted IPv6 mesh. About two months later Sandworm (GRU Unit 74455) used that access for a data-wiping attack. ESET attributes both stages with high confidence and says a Linux variant may exist.

Hunt: look for Yggdrasil traffic or binaries on hosts that have no reason to run them (unexpected 200::/7 IPv6 addresses or Yggdrasil peering on TCP/TLS), MATCHBOIL/MATCHWOK detections, and unknown Go binaries running SOCKS proxies. Treat a confirmed UAC-0099 intrusion as possible staging for a destructive attack, not just espionage. Full technical IOCs are in ESET's WeLiveSecurity write-up.