---
title: Hunt: UAC-0099 handed access to Sandworm, which wiped a Ukrainian grain firm; new Go backdoor MythicRatatoskr talks to C2 over the Yggdrasil mesh network | ctxsec
url: https://ctxsec.com/items/hunt-eset-uac-0099-sandworm-mythicratatoskr
description: ""
status: "vendor research (ESET, Oct 22)"
published: 2026-10-22
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-eset-uac-0099-sandworm-mythicratatoskr.md)

vendor research (ESET, Oct 22)

2026-10-22

### Hunt: UAC-0099 handed access to Sandworm, which wiped a Ukrainian grain firm; new Go backdoor MythicRatatoskr talks to C2 over the Yggdrasil mesh network

ESET says Russia-aligned **UAC-0099** got into a Ukrainian grain logistics company on **July 16, 2025** with a spearphishing attachment that led to its **MATCHBOIL** downloader and **MATCHWOK** backdoor. A day later it dropped **MythicRatatoskr**, a previously unknown Go backdoor (command execution, file transfer, screenshots, proxying, probably a SOCKS5 relay) whose C2 sits inside the **Yggdrasil** encrypted IPv6 mesh. About two months later **Sandworm** (GRU Unit 74455) used that access for a data-wiping attack. ESET attributes both stages with high confidence and says a Linux variant may exist.

**Hunt:** look for Yggdrasil traffic or binaries on hosts that have no reason to run them (unexpected `200::/7` IPv6 addresses or Yggdrasil peering on TCP/TLS), MATCHBOIL/MATCHWOK detections, and unknown Go binaries running SOCKS proxies. Treat a confirmed UAC-0099 intrusion as possible staging for a destructive attack, not just espionage. Full technical IOCs are in ESET's WeLiveSecurity write-up.

Sources: [ESET Research: UAC-0099 and Sandworm co-operate in wiping attack against Ukraine (Oct 22)](https://www.eset.com/us/about/newsroom/research/uac-0099-sandworm-wiping-attack-ukraine/)