Summary
- ESET links the initial compromise to UAC-0099 and later destructive activity to Sandworm.
- Researchers identify a new Go backdoor, MythicRatatoskr, using the Yggdrasil mesh network.
- The attack occurred in 2025; the 22 October 2026 report does not quantify losses or grain export disruption.
ESET researchers have connected the compromise of a Ukrainian grain logistics business to two separate Russia-aligned threat groups, documenting an initial intrusion attributed to UAC-0099 followed by destructive activity attributed to Sandworm. The report, published on 22 October 2026, describes a previously unknown backdoor and evidence that access from a July 2025 espionage intrusion was later used in a wiping attack.
The underlying intrusion began on 16 July 2025, when a spearphishing email containing a malicious attachment reached the unnamed grain logistics company. According to ESET, the resulting execution chain involved malware associated with UAC-0099, including the MATCHBOIL downloader and MATCHWOK backdoor. The researchers assess that group’s responsibility for the initial stage with high confidence, on the basis of established tooling and the observed sequence.
On 17 July 2025, the attackers deployed a Go-based backdoor that ESET named MythicRatatoskr. It performed conventional remote access functions, including command execution, file transfer, filesystem navigation and screenshot capture. Its distinguishing characteristic was its use of the Yggdrasil mesh network to conceal the location of its command infrastructure. Yggdrasil provides encrypted IPv6 communication between participating nodes, complicating the task of locating a conventional externally hosted command server.
The backdoor may also have supported traffic forwarding through a SOCKS5 proxy, potentially allowing operators to route additional activity through the compromised environment. ESET says it has not seen the same tool deployed elsewhere and has indications that a Linux variant could exist. These observations are narrower than a claim that the malware is widespread or that every affected system in the business had been identified.
From established access to data destruction
ESET attributes the later wiping operation, observed around September 2025 — approximately two months after the initial compromise — to Sandworm with high confidence. Sandworm is associated with Russia’s military intelligence service, and its historical operations have included attacks intended to interrupt or destroy systems rather than simply extract information. The research points to a handover between groups rather than a single operator performing every stage of this incident.
That division of activity changes how the intrusion can be interpreted. A compromise first detected as credential theft, remote access or espionage can leave an organisation exposed to a different actor whose objective is destructive. The first group need not maintain visible command activity throughout the intervening period if usable access or information has already been passed on. The report does not establish the commercial terms, internal coordination arrangements or a general operating relationship between the groups.
Ukrainian agricultural logistics depends on interconnected office systems, warehouses, transport planning and commercial records. A destructive intrusion against a company in this sector therefore affects a part of the economy with operational dependencies well beyond an individual workstation. ESET does not publicly identify the victim or quantify lost production, damage to cargo or disruption to grain shipments, so those outcomes cannot be inferred from the presence of wiping malware alone.
ESET notes that an earlier investigation found cooperation between Gamaredon and Turla, demonstrating that collaboration among Russia-aligned groups has occurred in other settings. The new grain sector case supplies a separate technical account of how an access operation developed into destructive activity. The company presented parts of the research at security conferences in September and October, before publishing its detailed account on 22 October.
The research also places separate confidence levels on different propositions. The researchers express high confidence in the malware-based UAC-0099 attribution and the later Sandworm wiping stage, while assessing the broader alignment of UAC-0099 with Russian interests at medium confidence. Those are intelligence assessments supported by specific observations, not admissions from the operators. Keeping that distinction visible prevents a single label of attribution from obscuring uncertainty about relationships between groups, particularly when an initial access operation occurs well before a destructive event.
The evidence available publicly identifies the attack sequence, tools and assessed operators, but leaves the affected company unnamed and the operational consequences unquantified. The account documents initial access in July 2025 and later destructive activity; neither the victim’s identity nor the volume of data erased has been published.
