Threat reportAPTTL-2026-4127
UAC-0099 and Sandworm joint intrusion and data-wiping attack on Ukrainian grain logistics company (MATCHBOIL, MATCHWOK, MythicRatatoskr over Yggdrasil)
UAC-0099 and Sandworm joint intrusion and data-wiping attack (TL-2026-4127), also tracked as MythicRatatoskr campaign, is a high-severity advanced persistent threat campaign, first published 2026-10-22. It is attributed to UAC-0099 (Russia) with medium confidence, affects Microsoft Windows endpoints and Active Directory Group Policy, maps to 21 MITRE ATT&CK techniques (T1021.004, T1027.013, T1036.005), and is covered by 9 detection rules and 28 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK
- Actors
- 2UAC-0099
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 28Indicators of compromise
Key facts for TL-2026-4127
- Threat ID
- TL-2026-4127
- Also known as
- MythicRatatoskr campaign, UAC-0099 and Sandworm collaboration
- Severity
- HIGH
- Status
- ACTIVE
- Category
- APT
- First published
- Last reviewed
- Attribution
- UAC-0099, Sandworm
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- DESTRUCTION
- Target sectors
- agriculture, logistics, government administration, finance, news - media
- Target regions
- ukraine, 151 - Eastern Europe
- Detection rules
- 9
- Indicators of compromise
- 28
Malware and tooling in UAC-0099 and Sandworm joint intrusion and data-wiping attack
Malware and tooling: Quasar RAT, SDelete - S0195
How UAC-0099 and Sandworm joint intrusion and data-wiping attack works
ESET documented a collaboration in which Russia-aligned UAC-0099 phished a Ukrainian grain logistics company in July 2025 and established a MATCHWOK foothold, after which Sandworm (GRU Unit 74455) deployed the previously unknown Go backdoor MythicRatatoskr, which uses the Yggdrasil mesh network for C2, and wiped data with SDelete via Group Policy on 2025-09-17.
In July 2025 UAC-0099, a Russia-aligned cyberespionage group active since 2022 that targets Ukrainian government, financial and media organizations, gained initial access to a Ukrainian grain logistics company. On 2025-07-16 a spearphishing email attachment led to a scheduled task named pdfopentask executing a PowerShell payload from %temp%\temporarydoc.txt. About a minute later the MATCHBOIL C# downloader fetched the MATCHWOK C# backdoor (screenshots, PowerShell execution) from egyptanimals[.]com and used uztickets[.]com as C&C. MATCHBOIL persisted through a HKCU Run value named UpdateMonitor. ESET assesses with medium confidence that UAC-0099 supplies initial access to Sandworm.
On 2025-07-17 the MythicRatatoskr backdoor was delivered to the initial machine. MythicRatatoskr is a Go backdoor developed between December 2024 and February 2025. It runs as an auto-start Windows service named ieupdate and masquerades under filenames such as updater.exe, krbtman.exe, windowsdefendersvc.exe, OneDriveLiveUpdater.exe and ieupdate.exe. Its configuration is AES-256-CFB encrypted with a hardcoded key and stored in dot-prefixed files (C:\Windows\Temp\.updatecache, C:\Windows\system32\.updatecache, %LocalAppData%\Temp\.crond). Some samples wait 10 minutes before first contact. The backdoor embeds a Yggdrasil node that joins the mesh through 3 of 32 hardcoded public peers and speaks JSON over HTTPS POST (checkin, tasking, result, getfile) to a C&C reachable only at a Yggdrasil IPv6 address on port 443. ESET states this is, to its knowledge, the first documented case of Yggdrasil being abused this way by a state-aligned actor. Commands: chtime, expose, upload, download, nodeinfo, screenshot, cd, ls, pwd, churl, proxy (reverse SOCKS5 start/stop) and shell (cmd.exe). A Linux variant is hinted at by an unused /tmp/.test_config path.
In August 2025 MythicRatatoskr was pushed to additional machines over OpenSSH SFTP and a Go SOCKS5 server (bindProxy, go-socks5, listening on 127.0.0.1:33690; krbtman.exe, nbtresolver.exe) was deployed. On 2025-09-17 Sandworm executed a data-wiping attack with SDelete distributed through Active Directory Group Policy. The operation was destructive, not ransomware. Public reporting by The Record (2026-10-21) accompanied ESET's LABScon 2026 research by Anton Cherepanov. Separate ESET research (2026-10-08) tracks MATCHBOIL's evolution (Eziriz .NET Reactor obfuscation, scheduled-task persistence, C&C hosting on BitLaunch/BL Networks VPS fronted by Cloudflare).
MITRE ATT&CK techniques used in TL-2026-4127
Lateral Movement
Defense Evasion
T1027.013 Encrypted/Encoded File; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks; T1678 Delay Execution
Execution
T1047 Windows Management Instrumentation; T1059.001 PowerShell; T1059.003 Windows Command Shell
Persistence
T1053.005 Scheduled Task; T1543.003 Windows Service; T1547.001 Registry Run Keys / Startup Folder
Command and Control
T1071.001 Web Protocols; T1090.001 Internal Proxy; T1090.003 Multi-hop Proxy; T1132.001 Standard Encoding; T1573 Encrypted Channel
Collection
Impact
Initial Access
T1566.001 Spearphishing Attachment
Resource Development
Affected products and versions in UAC-0099 and Sandworm joint intrusion and data-wiping attack
- Microsoft — Windows endpoints and Active Directory Group Policy
Vulnerable versions: Not version-specific; abuse of legitimate functionality and phishing
Remediation for UAC-0099 and Sandworm joint intrusion and data-wiping attack
Immediate actions
- Hunt for service ieupdate, scheduled task pdfopentask, HKCU Run value UpdateMonitor and the listed file hashes and paths
- Alert on creation or modification of Group Policy Objects that push sdelete or other wiping tools
- Block or alert on outbound Yggdrasil peer connections (the listed public peers) and on any traffic to the 200::/7 range from endpoints
- Block the listed C2 and staging domains and IPs
Workarounds
- Block execution from %TEMP% and user Downloads with application control
- Restrict internal OpenSSH/SFTP use between workstations to approved admin hosts
Longer-term hardening
- Restrict who can create and link GPOs and monitor GPO changes
- Alert on unexpected Go binaries running as Windows services from system32 or user Downloads folders
- Back up offline and test restoration for logistics and agriculture environments
- Train staff to report phishing links and attachments that deliver archives with VBScript
Timeline of UAC-0099 and Sandworm joint intrusion and data-wiping attack
- Approximate start of MythicRatatoskr development (ESET dates development December 2024 to February 2025)
- At 07:00 MATCHBOIL downloads the MATCHWOK backdoor from egyptanimals[.]com and persists via the UpdateMonitor Run value; C&C is uztickets[.]com
- UAC-0099 spearphishing attachment executes at 06:59 via scheduled task pdfopentask running a PowerShell payload from %temp%\temporarydoc.txt at the Ukrainian grain logistics company
- MythicRatatoskr backdoor delivered to the initial machine at 09:28, a day after initial access
- During August 2025 MythicRatatoskr is deployed to additional machines over OpenSSH SFTP and a SOCKS5 server is installed
- Sandworm runs a data-wiping attack using SDelete deployed through Active Directory Group Policy
- ESET publishes MATCHBOIL research covering the downloader's evolution and infrastructure
- ESET publishes MythicRatatoskr analysis (LABScon 2026) and The Record reports the UAC-0099 and Sandworm collaboration
Sources cited for UAC-0099 and Sandworm joint intrusion and data-wiping attack
- Russian hackers teamed up to wipe data at Ukrainian grain firm
- ESET Research: MythicRatatoskr, a Yggdrasil-enabled backdoor deployed in UAC-0099 and Sandworm collaboration
- ESET Research: MATCHBOIL: New tricks, same old evil intentions
- Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift
- Sandworm-Linked Group Sharpens Matchboil Downloader
- ESET: UAC-0099 MATCHBOIL Malware Evolves, Keeps Targeting Ukraine
- Sophisticated malware downloader MatchBoil targets Ukrainian organizations
Detection coverage for TL-2026-4127
As of 2026-10-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4127 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4127
1 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.