Fast Facts
- UAC-0099 gained access to a Ukrainian logistics company through a spear-phishing attachment that installed the MATCHWOK backdoor.
- It deployed MythicRatatoskr, which used Yggdrasil for C2 and enabled file transfer, command execution, screenshots, and SOCKS5 tunneling.
- Over two months later, Sandworm wiped data by distributing SDelete through Active Directory Group Policy.
Threat, Techniques, and Targets
• ESET linked UAC-0099, also known as Earth Sirrush, with Sandworm in an attack on a Ukrainian logistics company in 2025. UAC-0099 gained access through a spear phishing email with a malicious attachment.
• The attachment led to MATCHWOK, which the MATCHBOIL downloader installed. A day later, UAC-0099 deployed MythicRatatoskr, a previously undocumented backdoor that communicates through the Yggdrasil mesh network.
• MythicRatatoskr can collect victim details, run commands, take screenshots, transfer files, and create a SOCKS5 proxy. Some versions also delay startup by 10 minutes.
• After UAC-0099 handed access to Sandworm, Sandworm used Active Directory Group Policy to deploy SDelete and wipe data. ESET has also reported UAC-0099 activity targeting Ukrainian government, energy, logistics, and grain sectors.
Impact, Security Implications, and Remediation
• The attack destroyed data on the logistics company’s Windows system. In addition, the use of Yggdrasil for command and control may make it harder for defenders to identify malicious network traffic.
• The incident shows how one group can gain access and pass selected targets to another group for destructive operations. However, the report does not provide specific remediation steps.
• Organizations should obtain remediation guidance from the relevant vendor or cybersecurity authority.
Discover More Technology Insights
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Explore past and present digital transformations on the Internet Archive.
ThreatIntel-V1
