# UAC-0099 and Sandworm joint intrusion and data-wiping attack on Ukrainian grain logistics company (MATCHBOIL, MATCHWOK, MythicRatatoskr over Yggdrasil)

> ESET documented a collaboration in which Russia-aligned UAC-0099 phished a Ukrainian grain logistics company in July 2025 and established a MATCHWOK foothold, after which Sandworm (GRU Unit 74455) deployed the previously unknown Go backdoor MythicRatatoskr, which uses the Yggdrasil mesh network for C2, and wiped data with SDelete via Group Policy on 2025-09-17.

- **Published:** 2026-10-22T09:17:28Z
- **Last reviewed:** 2026-10-22T09:17:28Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4127
- **ID:** TL-2026-4127
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** UAC-0099 (Russia)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In July 2025 UAC-0099, a Russia-aligned cyberespionage group active since 2022 that targets Ukrainian government, financial and media organizations, gained initial access to a Ukrainian grain logistics company. On 2025-07-16 a spearphishing email attachment led to a scheduled task named pdfopentask executing a PowerShell payload from %temp%\temporarydoc.txt. About a minute later the MATCHBOIL C# downloader fetched the MATCHWOK C# backdoor (screenshots, PowerShell execution) from egyptanimals[.]com and used uztickets[.]com as C&C. MATCHBOIL persisted through a HKCU Run value named UpdateMonitor. ESET assesses with medium confidence that UAC-0099 supplies initial access to Sandworm.

On 2025-07-17 the MythicRatatoskr backdoor was delivered to the initial machine. MythicRatatoskr is a Go backdoor developed between December 2024 and February 2025. It runs as an auto-start Windows service named ieupdate and masquerades under filenames such as updater.exe, krbtman.exe, windowsdefendersvc.exe, OneDriveLiveUpdater.exe and ieupdate.exe. Its configuration is AES-256-CFB encrypted with a hardcoded key and stored in dot-prefixed files (C:\Windows\Temp\.updatecache, C:\Windows\system32\.updatecache, %LocalAppData%\Temp\.crond). Some samples wait 10 minutes before first contact. The backdoor embeds a Yggdrasil node that joins the mesh through 3 of 32 hardcoded public peers and speaks JSON over HTTPS POST (checkin, tasking, result, getfile) to a C&C reachable only at a Yggdrasil IPv6 address on port 443. ESET states this is, to its knowledge, the first documented case of Yggdrasil being abused this way by a state-aligned actor. Commands: chtime, expose, upload, download, nodeinfo, screenshot, cd, ls, pwd, churl, proxy (reverse SOCKS5 start/stop) and shell (cmd.exe). A Linux variant is hinted at by an unused /tmp/.test_config path.

In August 2025 MythicRatatoskr was pushed to additional machines over OpenSSH SFTP and a Go SOCKS5 server (bindProxy, go-socks5, listening on 127.0.0.1:33690; krbtman.exe, nbtresolver.exe) was deployed. On 2025-09-17 Sandworm executed a data-wiping attack with SDelete distributed through Active Directory Group Policy. The operation was destructive, not ransomware. Public reporting by The Record (2026-10-21) accompanied ESET's LABScon 2026 research by Anton Cherepanov. Separate ESET research (2026-10-08) tracks MATCHBOIL's evolution (Eziriz .NET Reactor obfuscation, scheduled-task persistence, C&C hosting on BitLaunch/BL Networks VPS fronted by Cloudflare).

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1047 Windows Management Instrumentation
- T1543.003 Windows Service
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1027.013 Encrypted/Encoded File
- T1678 Delay Execution
- T1497.001 System Checks
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1021.004 SSH
- T1113 Screen Capture
- T1071.001 Web Protocols
- T1090.001 Internal Proxy
- T1090.003 Multi-hop Proxy
- T1573 Encrypted Channel
- T1132.001 Standard Encoding
- T1583.003 Virtual Private Server
- T1485 Data Destruction

## Sources

- [Russian hackers teamed up to wipe data at Ukrainian grain firm](https://therecord.media/ukraine-hackers-russia-grain-sandworm)
- [ESET Research: MythicRatatoskr, a Yggdrasil-enabled backdoor deployed in UAC-0099 and Sandworm collaboration](https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/)
- [ESET Research: MATCHBOIL: New tricks, same old evil intentions](https://www.welivesecurity.com/en/eset-research/matchboil-new-tricks-same-old-evil-intentions/)
- [Russian Spies Give 'MatchBoil' Malware a Stealthy Facelift](https://www.darkreading.com/cyberattacks-data-breaches/russian-spies-matchboil-malware-facelift)
- [Sandworm-Linked Group Sharpens Matchboil Downloader](https://www.govinfosecurity.com/sandworm-linked-group-sharpens-matchboil-downloader-a-33037)
- [ESET: UAC-0099 MATCHBOIL Malware Evolves, Keeps Targeting Ukraine](https://www.technadu.com/matchboil-malware-evolves-as-uac-0099-continues-to-target-ukraine/641381/)
- [Sophisticated malware downloader MatchBoil targets Ukrainian organizations](https://www.scworld.com/brief/sophisticated-malware-downloader-matchboil-targets-ukrainian-organizations)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4127