THE Hacker News reports that Sandworm, the Russian state‑sponsored group, worked with another actor to mount a destructive wiping operation against a Ukrainian logistics company. The operation began with initial access on 16 July 2025, delivered via a spear‑phishing email that carried a malware‑laced attachment. This led to the deployment of the MATCHWOK backdoor through a downloader named MATCHBOIL, after which access was handed off to Sandworm. The campaign culminated on 17 September 2025 when Sandworm executed a data‑wiping attack using SDelete, delivered via Active Directory Group Policy.
A notable technical detail is the use of a previously undocumented backdoor, MythicRatatoskr, which communicated with a command‑and‑control server hosted inside the Yggdrasil mesh network.
MythicRatatoskr reportedly began development between December 2024 and February 2025, and, in addition to standard backdoor functions (exfiltrating victim metadata, polling for commands, transmitting outputs, screen captures, and file transfers), it can alter the working directory, enumerate directories, change the C2 URL, execute shell commands, and spawn a reverse SOCKS5 proxy. Some artefacts show a 10‑minute startup delay to evade early detection by the Yggdrasil network.
ESET notes this is the first documented case of Yggdrasil being abused by a state‑aligned actor, and suggests this could mark a broader shift toward peer‑to‑peer networks to bolster resilience and stealth. The report also indicates that the operation involved collaboration between Russia‑aligned groups, with prior examples of cross‑group cooperation observed by researchers.