Russia-aligned hackers used a previously undocumented backdoor and a decentralized mesh network during an intrusion that culminated in a destructive attack against a Ukrainian grain logistics company, according to ESET Research. The operation began on July 16, 2025, when UAC-0099, also known as Earth Sirrush, sent a spear-phishing email containing a malicious attachment.
The attachment launched the MATCHBOIL downloader, which installed the MATCHWOK backdoor. The following day, the attackers deployed MythicRatatoskr, a previously unknown backdoor written in Go. ESET said the malware communicated with a command-and-control server hosted inside Yggdrasil, a decentralized mesh network that uses an experimental routing scheme and end-to-end-protected IPv6 connections.
MythicRatatoskr gave the operators capabilities including command execution, filesystem navigation, file transfer, screenshot capture and proxying. ESET said the backdoor was likely used to deploy a SOCKS5 server, allowing the attackers to route connections through the compromised network and complicate network-based detection. Researchers have not seen the malware used elsewhere and said there are indications that a Linux variant may also exist.
The intrusion later ended in a data-wiping attack against the grain company. ESET assesses with high confidence that UAC-0099 obtained the initial foothold and subsequently handed access to Sandworm, which carried out the destructive activity. ESET attributes Sandworm to Russia’s military intelligence service, the GRU, and said the group’s involvement was supported by the tactics, techniques and procedures used in the wiping operation. The researchers assessed UAC-0099’s alignment with Russian interests with medium confidence, based primarily on its targeting and activity.
The incident is significant for defenders because it combines an initial-access operation with a later destructive intrusion and places command infrastructure outside conventional centralized hosting. Organizations supporting Ukrainian logistics, grain, port and other critical sectors should scrutinize spear-phishing attachments, investigate MATCHBOIL and MATCHWOK activity, monitor for unauthorized Yggdrasil installations and SOCKS5 proxying, and maintain offline, tested backups. ESET’s published findings identify no CVE associated with the intrusion, so patching a specific vulnerability is not the remedy; endpoint hardening, phishing resistance, network segmentation and rapid isolation remain central defenses.
