MythicRatatoskr Backdoor Uses Yggdrasil Mesh to Hide C&C, Enables Sandworm Data-Wipe

MythicRatatoskr is a Go-based backdoor first observed in July 2025. It was delivered by the UAC-0099 threat group through a spearphishing attachment that triggered a PowerShell payload. The payload created a scheduled task named pdfopentask, which executed a temporary document that launched the MATCHBOIL downloader. MATCHBOIL then fetched the MATCHWOK backdoor from a malicious domain. One hour later, a new binary – MythicRatatoskr – appeared on the same machine.

The backdoor embeds a Yggdrasil IPv6 address as its C&C endpoint. Yggdrasil is a decentralized mesh network that encrypts traffic end-to-end. By hosting its C&C inside this network, MythicRatatoskr avoids traditional DNS or HTTP channels that are easier to block or monitor. ESET telemetry shows the backdoor opening a SOCKS5 proxy on several infected hosts, which it used to tunnel traffic to the Yggdrasil node.

On 17 Sep 2025, the compromised Ukrainian grain logistics company experienced a data-wipe. Sandworm, the Russian-aligned actor attributed to GRU Unit 74455, deployed the SDelete utility via an Active Directory Group Policy change. The wipe followed the initial access chain that began with UAC-0099. No evidence of data exfiltration was found; the primary damage was the loss of critical business data.

UAC-0099, a Russian-aligned group, delivered the initial payload. Evidence shows that the same machines later received MythicRatatoskr, suggesting a handover to Sandworm. This cooperation mirrors earlier documented collaborations between Russia-aligned actors such as Gamaredon and Turla. The handover is unusual in the specific actors but fits a broader pattern of joint operations aimed at amplifying impact.

• Scheduled task named pdfopentask executing a PowerShell script from %temp%.
• Download of MATCHBOIL from a domain ending in .com and subsequent deployment of MATCHWOK.
• Presence of a Go-compiled binary named MythicRatatoskr on the system.
• SOCKS5 server listening on a non-standard port, with traffic routed to a Yggdrasil IPv6 address.
• Group Policy changes that deploy SDelete or other wiping utilities.

Monitoring for these indicators can help detect similar campaigns early.

1. Block outbound traffic to known Yggdrasil IPv6 prefixes used by the backdoor.
2. Disable or restrict the creation of scheduled tasks that run PowerShell from temporary directories.
3. Harden Group Policy by restricting the deployment of third-party utilities such as SDelete.
4. Deploy endpoint detection that flags unknown Go binaries and SOCKS5 proxies.
5. Conduct regular backups and test restore procedures to mitigate data-wipe impacts.

Implementing these controls reduces the attack surface and limits the effectiveness of the backdoor.

Yggdrasil is a decentralized mesh network that uses experimental routing to provide end-to-end encrypted IPv6 communication between nodes. Its design makes it difficult for defenders to locate or block the C&C server, as the traffic appears as legitimate IPv6 traffic within the mesh. The use of Yggdrasil by MythicRatatoskr represents the first known deployment of this network by a threat actor for command and control.

The UAC-0099 to Sandworm handover demonstrates that Russian-aligned groups are willing to share compromised infrastructure to achieve larger objectives. This collaboration increases the operational reach of each actor and complicates attribution. Defenders should treat such partnerships as a single, more capable threat when assessing risk.

• Whether a Linux variant of MythicRatatoskr exists and how it might differ.
• The full extent of data exfiltration, if any, that may have occurred before the wipe.
• The precise method by which the backdoor discovered and connected to the Yggdrasil node.

Further analysis of captured traffic and binaries may clarify these points.