A backdoor that parks its command server inside a peer-to-peer mesh network has turned up in a destructive intrusion against a Ukrainian logistics company, ESET reported this week.
The implant, MythicRatatoskr, reaches its controller through Yggdrasil, an overlay network designed to route traffic without central infrastructure. ESET’s Anton Cherepanov and Peter Strycek called it the first documented case of a state-aligned actor abusing the network this way. Certificates and takedowns cannot sever a link that has no fixed address to seize.
Two crews, two months apart
The entry came on July 16, 2025. UAC-0099, also tracked as Earth Sirrush, sent a spear-phishing message with a malicious attachment that pulled in the MATCHWOK backdoor through a downloader called MATCHBOIL.
MythicRatatoskr landed a day later, carrying a ten-minute startup delay – apparently an attempt to avoid connecting to the mesh the moment the machine woke. The code dates from late 2024 or early 2025. Functionality is ordinary: it reports host metadata, polls for instructions, returns output, takes screenshots and moves files. It also opens a reverse SOCKS5 proxy so the operators can route other traffic through the victim.
More than two months after the first foothold, access changed hands. Sandworm stepped in and pushed SDelete across the estate through Active Directory Group Policy, wiping the company’s systems on September 17, 2025. Sandworm’s own NikoWiper shares that lineage.
Why the mesh matters
Most command infrastructure depends on a domain or an IP range, and defenders have learned to watch both. A mesh-hosted controller removes that lever.
References to crond inside the implant suggest a Linux build may exist alongside the Windows one.
Hunt for beacon-like traffic to Yggdrasil peers, GPO-delivered SDelete executions, and the MATCHWOK file artifacts in your logs.
