Search — “Sandworm”

ESET reports that UAC-0099 gained access to a Ukrainian grain logistics company via phishing with a malicious attachment in July 2025, installed the MatchWok backdoor, then deployed the previously unknown MythicRatatoskr tool. Researchers believe UAC-0099 handed access to GRU-linked Sandworm, which carried out a data-wiping attack in September 2025. The malware used the decentralized Yggdrasil network for C2, which ESET calls the first documented state-aligned abuse of that network this way. Hunters should look for Yggdrasil-related network activity from unexpected hosts and for MatchWok or MythicRatatoskr artifacts, though the source prints no specific strings.