Sandworm, the Russian state-sponsored hacking group, wiped data at a Ukrainian grain logistics company in September 2025, using a backdoor that most network defenders were never built to watch. ESET published its findings on October 22, and The Hacker News and SC World picked them up the next day. The victim has not been named, and the total impact remains unknown.

The attack was not the work of one crew. ESET said two Russia-aligned groups worked together, with UAC-0099 serving as the initial access broker and Sandworm carrying out the destruction. The collaboration itself is not new. ESET's 2025 activity report already said that UAC-0099 passed validated targets to Sandworm, so this case is less a surprise partnership than a detailed look at how one ended in a wiper attack.

How the Sandworm hackers and UAC-0099 split the work

An initial access broker gets into a network first, then hands that foothold to another actor who decides what to do with it. In this case, UAC-0099 handled the early stage and Sandworm supplied the destructive payload. That division keeps the group that wants the damage away from the initial break-in. It also lets the broker reuse access it has already validated against a target.

The timeline from a July phishing email to a September wipe

ESET's reconstruction, as reported by ThreatTicker and others, runs roughly as follows:

  • July 16, 2025: A spearphishing email carrying a malicious attachment reached the target. A scheduled task then ran a PowerShell payload the same day.
  • Later in the intrusion: The attackers deployed MythicRatatoskr, a Go backdoor that no public record had documented before.
  • September 17, 2025: Sandworm wiped data by dropping the SDelete utility through Active Directory Group Policy.

The gap between the first foothold and the wipe was more than two months. One DEV Community write-up puts the dwell time at 63 days, which matches the July 16 start and the September 17 destruction date. That is a long time for an intruder to sit inside a network before acting.

What MythicRatatoskr does once it lands

The backdoor sends victim metadata to its command-and-control server, then polls that server for instructions. It can take screenshots, move files and spawn a reverse SOCKS5 proxy. A reverse proxy lets an operator route traffic through the infected machine, which can reach systems an outside attacker could not touch directly.

Some artifacts show a 10-minute startup delay. Researchers believe the wait keeps the malware from connecting to Yggdrasil right away, which may help it avoid detection.

The unusual part is the command channel. ESET calls this likely the first documented case of a state-aligned group abusing Yggdrasil to hide command traffic. Because Yggdrasil is a mesh overlay network, defenders who watch only for connections to known bad domains may never see the control traffic.

The toolkit also resembles legitimate administration software. Sandworm's NikoWiper malware is derived from SDelete, a file-deletion tool from Microsoft's Sysinternals suite, so a wipe built on it can look like routine admin work until the data is gone.

Why a backdoor without a CVE slips past normal patching

ESET says no CVE or vendor patch applies to this intrusion, because it relied on phishing, normal admin tools and an overlay network. That removes the usual signal. A patch advisory tells a security team which product to update. Here, the weak points were a user who opened an attachment, an administrative channel that pushed a tool, and a network path nobody was checking.

The contrast with Microsoft's October 13 Patch Tuesday is useful. The Hacker News reported that Microsoft fixed a record 1,413 flaws that month, including an exploited Windows Shell zero-day tracked as CVE-2026-96951, as SOCRadar also documented. Those fixes matter, but they close known doors. They do not reveal a backdoor that arrived by email and hid its command traffic inside a mesh network.

What security teams should check this week

  • Review outbound network egress for Yggdrasil or other peer-to-peer overlay traffic. Following ESET's suggested approach, consider blocking public Yggdrasil peers wherever the business has no need for them.
  • Alert on Active Directory Group Policy changes that push file-deletion or wiping utilities such as SDelete. Treat unexpected SDelete execution as an incident until proven otherwise.
  • Hunt for phishing-delivered Go binaries, scheduled tasks that launch PowerShell, and unusual reverse proxy activity, even when no vulnerability is involved.
  • Pull indicators from ESET's full report before building detections. The summaries available for this story do not list file hashes or domains, so rules built from them would be guesswork.

Ordinary consumers have no specific step to take from this story.

Why the US angle is indirect so far

Reporting so far shows no US victims in this campaign. The risk for American readers is structural. Logistics, agriculture and critical-infrastructure companies that allow unmonitored outbound overlay traffic face the same detection gap as the Ukrainian victim, whether or not a state actor has targeted them.

The attribution details also call for caution. Risky Bulletin described the victim as a grain export logistics firm and the actor as a Russian military cyber unit, but that description comes from a single newsletter. The sources reviewed for this story did not include independent confirmation from a government agency, so the UAC-0099 and Sandworm link remains ESET's assessment.

Destructive activity is not confined to this campaign. USA 24 has reported that the FBI and CISA warned about SafePay ransomware, which has hit more than 600 victims. A separate report covered AI-assisted INC and The Gentlemen ransomware operations that hit 62 targets.

What to watch next

Three developments will show how much this matters. The first is whether ESET's full technical report or a government advisory publishes indicators that let teams search for MythicRatatoskr and NikoWiper directly. The second is whether the victim is named, or whether a government agency confirms the Sandworm and UAC-0099 link. The third is whether other researchers find Yggdrasil in other intrusions. A single case can be an outlier, while a second case would point to a pattern.

If the technique spreads, defenders will face a harder question than patching. They will need to decide whether mesh-network traffic has any legitimate place in their environment, and if it does not, whether they are willing to block it at the network edge.