ESET Ties Ukraine Grain Firm Wipe to 2 Russian Groups

Ratatoskr, in Norse myth, is the squirrel that runs messages up and down Yggdrasil, the world tree. ESET has given that name to a previously unknown backdoor found inside a Ukrainian grain logistics company. The malware sent its traffic through Yggdrasil too: not the tree, but a decentralised mesh network of the same name. About two months after it arrived, the company’s data was wiped.

The attack itself is more than a year old. It ran from July to September 2025. What is new is ESET’s account of it, published on 22 October 2026. ESET says it shows one Russia-aligned group breaking in and passing access to another, Sandworm, which then carried out the destruction. The company has not been named.

TSN tracks attacks like this on its ransomware and cyber attacks hub.

One group broke in, another wiped the data

According to ESET’s telemetry, a group it tracks as UAC-0099 gained access on 16 July 2025 through a spear-phishing email with a malicious attachment. That set off a downloader called MATCHBOIL, which installed a backdoor called MATCHWOK. Because both tools are already linked to UAC-0099, ESET attributes this stage to the group “with high confidence”.

A day later, a new program appeared on the same machine: the backdoor ESET calls MythicRatatoskr. Copies were then spread to other machines in the company. On 17 September 2025, ESET detected data being wiped. The attackers used the SDelete utility, pushed out through Active Directory Group Policy. ESET says this is standard Sandworm practice, and it pins the wipe on Sandworm, also with high confidence, based on those techniques.

ESET notes that Sandworm is commonly attributed to Unit 74455 of the GRU, Russia’s military intelligence service. It says, with medium confidence, that UAC-0099 is aligned with Russian interests. The group spies on Ukrainian government bodies, financial institutions and media, and ESET believes it can act as an access broker for Sandworm. Even so, ESET says it has “not yet been able to determine” which of the two groups mainly ran MythicRatatoskr.

The backdoor’s control server lived inside a mesh network

MythicRatatoskr is written in Go and does what most backdoors do: it runs shell commands, browses files, uploads and downloads them, takes screenshots and acts as a proxy. What is unusual is how it reaches its operators. Rather than connecting to an ordinary internet server, it joins the public Yggdrasil network by picking three peers from a hard-coded list of 32. It then talks to a command-and-control server that sits inside the mesh.

Yggdrasil builds an encrypted IPv6 network on top of the internet without a central hub. ESET notes that hobbyists and researchers use it legitimately. Because no single server runs it, it is hard to disrupt, which also makes it attractive to attackers. “Importantly, Yggdrasil is not designed to provide anonymity,” ESET writes. Its researchers built their own map of the network and found the control server on it. They say blocking the public peer addresses is “a viable mitigation”.

“We have not seen MythicRatatoskr backdoor used anywhere else, and we found indications that a Linux variant may also exist,” ESET researcher Anton Cherepanov told The Record. The clues include configuration file paths written for Unix-style systems. Signs in the code suggest development began between December 2024 and February 2025, according to the blogpost.

A handoff ESET calls “no longer surprising”

ESET says this is “the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor”. It adds that the case “may signal a broader trend” of attackers turning to experimental peer-to-peer networks. That trend may or may not materialise; for now it is ESET’s reading of a single incident.

The cooperation between groups fits a pattern ESET has described before. Earlier in 2025 it documented Gamaredon working with Turla, both linked to Russia’s FSB. “A UAC-0099-to-Sandworm handoff is unusual in the specific actors involved, but no longer surprising as a pattern,” ESET writes. The Record notes that ESET reported last November that Sandworm had hit Ukrainian organisations in the grain, energy, logistics and government sectors between June and September 2025.

ESET first presented the findings at LABScon on 18 September 2026 and at the Virus Bulletin conference on 16 October. Its indicators of compromise, including the 32 peer addresses, are now public. The open question is the one ESET could not answer: if a Linux version exists, where is it running?