Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
Sandworm and UAC-0099 used a new mesh network backdoor in a destructive Ukraine attack.
Russian state-sponsored threat actors Sandworm and UAC-0099 (Earth Sirrush) collaborated on a destructive wiping attack against a Ukrainian logistics company. UAC-0099 gained initial access via spear-phishing, deploying the MATCHWOK backdoor and the novel MythicRatatoskr backdoor which utilized the Yggdrasil mesh network for C2 communication. Sandworm later executed a data-wiping attack using the SDelete utility.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ESET?
Get an email when a new story names ESET, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonRussian state-sponsored groups Sandworm and UAC-0099 combined spear-phishing for initial access with a novel mesh-network-based backdoor (MythicRatatoskr over Yggdrasil) to evade traditional C2 detection before executing a destructive wiper attack against a Ukrainian logistics company. The use of a decentralized peer-to-peer mesh network for command-and-control makes the malicious traffic extremely difficult to detect and block using conventional perimeter controls. The layered attack — phishing, persistent backdoors, then data destruction — demonstrates how undetected access can escalate into irreversible damage. This incident underscores that organizations, especially those in critical sectors, must combine robust email security, anomaly-based network monitoring, and tested backup and recovery capabilities to survive destructive nation-state attacks.
What helps against this
How we list vendors
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — MATCHWOK
- malware — MATCHBOIL
- malware — MythicRatatoskr
- malware — NikoWiper