Sandworm and UAC-0099 teamed up to wipe data at Ukrainian grain firm

ESET said UAC-0099 gained access to an unnamed Ukrainian grain logistics company in July 2025 via a phishing email with a malicious attachment, then handed access to Sandworm, which carried out a data-wiping attack in September. The hackers used new backdoors MatchWok and MythicRatatoskr and communicated through the decentralized Yggdrasil network.

• UAC-0099 breached the network in July 2025 via a phishing attachment
• Sandworm carried out a data-wiping attack in September 2025
• First documented abuse of Yggdrasil by a state-aligned actor
• ESET could not determine which group operated the MythicRatatoskr backdoor