Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
Summary: ESET reported that UAC-0099 (Earth Sirrush) gained initial access to a Ukrainian logistics company on July 16, 2025, through a spear-phishing email with a malware-laced attachment, deploying the MATCHWOK backdoor via a downloader called MATCHBOIL. The access was handed to Sandworm, which carried out a data-wiping attack on September 17, 2025, using the SDelete utility dropped through Active Directory Group Policy, after UAC-0099 deployed a previously undocumented backdoor called MythicRatatoskr that communicates with a command-and-control server hosted inside the Yggdrasil mesh network.
Bottom line: ESET called this the first documented case of a state-aligned actor abusing Yggdrasil, a peer-to-peer mesh network, to host command-and-control - infrastructure that does not depend on conventional domains or servers your blocklists and takedowns are built to catch. The intruders held a foothold for more than two months before Sandworm wiped the network, a dwell time that argues for detecting the initial access, not just the destructive finale.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026