ESET Research on Nostr: #ESETresearch uncovered #MythicRatatoskr, an undocumented Go backdoor hiding its C&C ...

#ESETresearch uncovered #MythicRatatoskr, an undocumented Go backdoor hiding its C&C server inside the #Yggdrasil mesh network. It was used against a Ukrainian 🇺🇦 grain logistics firm in an intrusion that ended in a destructive #Sandworm attack.
https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/
On July 16th, 2025, #UAC 0099 gained initial access via a spearphishing email, leading to an execution chain dropping the #MATCHWOK backdoor. One day later, the attackers deployed a previously unknown backdoor we named MythicRatatoskr.
#Yggdrasil is a decentralized, end-to-end-encrypted IPv6 mesh network. Nodes are addressed by their public keys, and no central server runs the mesh – making it hard to disrupt. To our knowledge, this is the first documented abuse of Yggdrasil by a state-aligned threat actor.
Yggdrasil is not designed for anonymity, so we generated a map of the network’s spanning tree to locate the C&C server. It sits near the center of the tree, making it easily reachable from other peers.
Two months later, on September 17th, 2025, #Sandworm wiped data across the company’s network using SDelete deployed via Active Directory Group Policy. We assess with high confidence that UAC 0099 handed off access to Sandworm during the intrusion.
IoCs are available in our GitHub repo: https://github.com/eset/malware-ioc/tree/master/mythicratatoskr