# Sandworm Used a Hidden Yggdrasil Backdoor to Wipe a Ukrainian Firm

- URL: https://usa-24.com/sandworm-hackers-yggdrasil-backdoor/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-25T16:49:54.098Z
- Updated: 2026-10-25T16:49:54.103Z
- Topics: Sandworm, Wiper Malware, Yggdrasil, Nation-State Hacking, Ukraine Cyberattacks

> ESET says Sandworm and the UAC-0099 access broker wiped a Ukrainian grain logistics firm using a backdoor hidden in the Yggdrasil mesh network, and no patch exists to block it.

## Key takeaways

- ESET reported on October 22, 2026 that Sandworm wiped data at an unnamed Ukrainian grain logistics company on September 17, 2025.
- UAC-0099 acted as the initial access broker after a July 16, 2025 spearphishing email carried a malicious attachment into the network.
- The MythicRatatoskr backdoor hides its command-and-control server inside the Yggdrasil mesh network, which ESET calls likely the first documented state-aligned use of that technique.
- ESET says no CVE or vendor patch applies, and its suggested mitigation is blocking public Yggdrasil peers.
- Reporting so far shows no US victims, so the US risk lies in unmonitored outbound overlay traffic at logistics, agriculture and infrastructure firms.

Sandworm, the Russian state-sponsored hacking group, wiped data at a Ukrainian grain logistics company in September 2025, using a backdoor that most network defenders were never built to watch. ESET published its findings on October 22, and [The Hacker News](https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html) and [SC World](https://www.scworld.com/brief/russian-hackers-collaborate-on-destructive-cyberattack-against-ukrainian-logistics-firm) picked them up the next day. The victim has not been named, and the total impact remains unknown.

The attack was not the work of one crew. ESET said two Russia-aligned groups worked together, with UAC-0099 serving as the initial access broker and Sandworm carrying out the destruction. The collaboration itself is not new. ESET's 2025 activity report already said that UAC-0099 passed validated targets to Sandworm, so this case is less a surprise partnership than a detailed look at how one ended in a wiper attack.

## How the Sandworm hackers and UAC-0099 split the work

An initial access broker gets into a network first, then hands that foothold to another actor who decides what to do with it. In this case, UAC-0099 handled the early stage and Sandworm supplied the destructive payload. That division keeps the group that wants the damage away from the initial break-in. It also lets the broker reuse access it has already validated against a target.

## The timeline from a July phishing email to a September wipe

ESET's reconstruction, as reported by [ThreatTicker](https://threatticker.com/news/mythicratatoskr-backdoor-hid-in-yggdrasil-mesh-before-sandworm-wiped-ukrainian) and others, runs roughly as follows:

- July 16, 2025: A spearphishing email carrying a malicious attachment reached the target. A scheduled task then ran a PowerShell payload the same day.
- Later in the intrusion: The attackers deployed MythicRatatoskr, a Go backdoor that no public record had documented before.
- September 17, 2025: Sandworm wiped data by dropping the SDelete utility through Active Directory Group Policy.

The gap between the first foothold and the wipe was more than two months. One [DEV Community write-up](https://dev.to/etairos/sandworm-wiper-attack-in-ukraine-used-mythicratatoskr-a-new-backdoor-with-c2-inside-the-yggdrasil-4o21) puts the dwell time at 63 days, which matches the July 16 start and the September 17 destruction date. That is a long time for an intruder to sit inside a network before acting.

## What MythicRatatoskr does once it lands

The backdoor sends victim metadata to its command-and-control server, then polls that server for instructions. It can take screenshots, move files and spawn a reverse SOCKS5 proxy. A reverse proxy lets an operator route traffic through the infected machine, which can reach systems an outside attacker could not touch directly.

Some artifacts show a 10-minute startup delay. Researchers believe the wait keeps the malware from connecting to Yggdrasil right away, which may help it avoid detection.

The unusual part is the command channel. ESET calls this likely the first documented case of a state-aligned group abusing Yggdrasil to hide command traffic. Because Yggdrasil is a mesh overlay network, defenders who watch only for connections to known bad domains may never see the control traffic.

The toolkit also resembles legitimate administration software. Sandworm's NikoWiper malware is derived from SDelete, a file-deletion tool from Microsoft's Sysinternals suite, so a wipe built on it can look like routine admin work until the data is gone.

## Why a backdoor without a CVE slips past normal patching

ESET says no CVE or vendor patch applies to this intrusion, because it relied on phishing, normal admin tools and an overlay network. That removes the usual signal. A patch advisory tells a security team which product to update. Here, the weak points were a user who opened an attachment, an administrative channel that pushed a tool, and a network path nobody was checking.

The contrast with Microsoft's October 13 Patch Tuesday is useful. [The Hacker News reported](https://thehackernews.com/2026/10/microsoft-patches-record-1413-flaws.html) that Microsoft fixed a record 1,413 flaws that month, including an exploited Windows Shell zero-day tracked as CVE-2026-96951, as [SOCRadar](https://socradar.io/blog/october-2026-patch-tuesday-zero-day/) also documented. Those fixes matter, but they close known doors. They do not reveal a backdoor that arrived by email and hid its command traffic inside a mesh network.

## What security teams should check this week

- Review outbound network egress for Yggdrasil or other peer-to-peer overlay traffic. Following ESET's suggested approach, consider blocking public Yggdrasil peers wherever the business has no need for them.
- Alert on Active Directory Group Policy changes that push file-deletion or wiping utilities such as SDelete. Treat unexpected SDelete execution as an incident until proven otherwise.
- Hunt for phishing-delivered Go binaries, scheduled tasks that launch PowerShell, and unusual reverse proxy activity, even when no vulnerability is involved.
- Pull indicators from ESET's full report before building detections. The summaries available for this story do not list file hashes or domains, so rules built from them would be guesswork.

Ordinary consumers have no specific step to take from this story.

## Why the US angle is indirect so far

Reporting so far shows no US victims in this campaign. The risk for American readers is structural. Logistics, agriculture and critical-infrastructure companies that allow unmonitored outbound overlay traffic face the same detection gap as the Ukrainian victim, whether or not a state actor has targeted them.

The attribution details also call for caution. [Risky Bulletin](https://news.risky.biz/risky-bulletin-supply-chain-attack-lets-ransomware-group-inside-40-shipping-companies) described the victim as a grain export logistics firm and the actor as a Russian military cyber unit, but that description comes from a single newsletter. The sources reviewed for this story did not include independent confirmation from a government agency, so the UAC-0099 and Sandworm link remains ESET's assessment.

Destructive activity is not confined to this campaign. USA 24 has reported that the FBI and CISA warned about [SafePay ransomware](https://usa-24.com/safepay-ransomware-advisory-fbi-cisa/), which has hit more than 600 victims. A separate report covered [AI-assisted INC and The Gentlemen ransomware](https://usa-24.com/inc-ransomware-ai-attacks/) operations that hit 62 targets.

## What to watch next

Three developments will show how much this matters. The first is whether ESET's full technical report or a government advisory publishes indicators that let teams search for MythicRatatoskr and NikoWiper directly. The second is whether the victim is named, or whether a government agency confirms the Sandworm and UAC-0099 link. The third is whether other researchers find Yggdrasil in other intrusions. A single case can be an outlier, while a second case would point to a pattern.

If the technique spreads, defenders will face a harder question than patching. They will need to decide whether mesh-network traffic has any legitimate place in their environment, and if it does not, whether they are willing to block it at the network edge.

## Frequently asked questions

### What is the MythicRatatoskr backdoor?

MythicRatatoskr is a previously undocumented Go backdoor that ESET says Sandworm and UAC-0099 used in a 2025 attack on a Ukrainian grain logistics company. It sends victim data to a command server, polls for instructions, takes screenshots, moves files and can spawn a reverse SOCKS5 proxy. Its command server sits inside the Yggdrasil mesh network, which makes its control traffic harder to spot.

### Who are Sandworm and UAC-0099?

Sandworm is a Russian state-sponsored hacking group. According to ESET, UAC-0099 acted as the initial access broker, getting into the victim's network before Sandworm carried out the destructive wipe. ESET had already reported in its 2025 activity report that UAC-0099 passed validated targets to Sandworm.

### Is there a patch that stops this attack?

No. ESET says no CVE or vendor patch applies, because the intrusion relied on phishing, normal admin tools and an overlay network. ESET's suggested mitigation is blocking public Yggdrasil peers, since that traffic may otherwise evade network security tools.

### Does this Sandworm campaign affect US companies?

Reporting so far shows no US victims in this campaign. US logistics, agriculture and critical-infrastructure companies that allow unmonitored outbound overlay traffic face the same detection gap, however. Security teams there can review egress traffic for Yggdrasil and monitor Group Policy pushes of wiping tools such as SDelete.

## Sources

1. [Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack, The Hacker News](https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html)
2. [MythicRatatoskr backdoor hid in Yggdrasil mesh before Sandworm wiped Ukrainian grain firm, ThreatTicker](https://threatticker.com/news/mythicratatoskr-backdoor-hid-in-yggdrasil-mesh-before-sandworm-wiped-ukrainian)
3. [Russian hackers collaborate on destructive cyberattack against Ukrainian logistics firm, SC World](https://www.scworld.com/brief/russian-hackers-collaborate-on-destructive-cyberattack-against-ukrainian-logistics-firm)
4. [Sandworm Wiper Attack in Ukraine Used MythicRatatoskr, a New Backdoor With C2 Inside the Yggdrasil Mesh Network, DEV Community (Etairos)](https://dev.to/etairos/sandworm-wiper-attack-in-ukraine-used-mythicratatoskr-a-new-backdoor-with-c2-inside-the-yggdrasil-4o21)
5. [Risky Bulletin: Supply chain attack lets ransomware group inside 40+ shipping companies, Risky.Biz](https://news.risky.biz/risky-bulletin-supply-chain-attack-lets-ransomware-group-inside-40-shipping-companies)
6. [Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Shell Bug, The Hacker News](https://thehackernews.com/2026/10/microsoft-patches-record-1413-flaws.html)
7. [October 2026 Patch Tuesday: 1,413 Flaws, 3 Zero-Days, SOCRadar](https://socradar.io/blog/october-2026-patch-tuesday-zero-day/)