Sandworm used Yggdrasil mesh network as C2 channel before wiping Ukrainian grain firm

ESET documented the first state-aligned abuse of Yggdrasil for command-and-control: the Go-based backdoor MythicRatatoskr gave Russian-linked operators 63 days of access to a Ukrainian grain logistics company before Sandworm wiped its data with a legitimate Microsoft tool. The decentralized mesh has no domain or server to seize or sinkhole.

• MythicRatatoskr is written in Go; development began between December 2024 and February 2025
• Intrusion started July 16, 2025 with spear-phishing delivering the MATCHBOIL downloader
• Backdoor can rotate its C2 URL, spawn a SOCKS5 proxy and delay startup by 10 minutes
• Yggdrasil does not anonymize users like Tor but resists takedowns