Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
Sandworm and UAC-0099 used a new mesh network backdoor in a destructive Ukraine attack.
Run ESET?
Get an email when a reviewed story names ESET, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
Russian state-sponsored threat actors Sandworm and UAC-0099 (Earth Sirrush) collaborated on a destructive wiping attack against a Ukrainian logistics company. UAC-0099 gained initial access via spear-phishing, deploying the MATCHWOK backdoor and the novel MythicRatatoskr backdoor which utilized the Yggdrasil mesh network for C2 communication. Sandworm later executed a data-wiping attack using the SDelete utility.
The lesson from this incident
Full lessonRussian state-sponsored groups Sandworm and UAC-0099 combined spear-phishing for initial access with a novel mesh-network-based backdoor (MythicRatatoskr over Yggdrasil) to evade traditional C2 detection before executing a destructive wiper attack against a Ukrainian logistics company. The use of a decentralized peer-to-peer mesh network for command-and-control makes the malicious traffic extremely difficult to detect and block using conventional perimeter controls. The layered attack — phishing, persistent backdoors, then data destruction — demonstrates how undetected access can escalate into irreversible damage. This incident underscores that organizations, especially those in critical sectors, must combine robust email security, anomaly-based network monitoring, and tested backup and recovery capabilities to survive destructive nation-state attacks.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
- malware — MATCHWOK
- malware — MATCHBOIL
- malware — MythicRatatoskr
- malware — NikoWiper