Analysis of a multi-stage campaign targeting a Ukrainian logistics company reveals how threat actor UAC-0099 handed off initial spear-phishing access to the Sandworm group for a later wiper attack.
The intrusion utilized custom backdoors, including MythicRatatoskr communicating via the Yggdrasil mesh network, before deploying SDelete via Active Directory.
How did they get into the company's systems?
The initial access began on July 16, 2025, when the UAC-0099 group sent a deceptive email with an attachment hiding malicious software. This action led to the installation of a tracker and, a day later, a new, previously unknown remote control program called MythicRatatoskr.
This new program stands out because it communicated with the perpetrators via an alternative communication network. Researchers say this is the first time a state-sponsored group has been recorded using this method. The program was likely created between December 2024 and February 2025, and had the ability to collect information about the victim, execute commands, take screenshots, transfer files, and delay its launch for ten minutes to avoid arousing suspicion.
The final destruction of files
After the first group gained access to the systems, it handed over control to the well-known Sandworm group. More than two months later, on September 17, 2025, Sandworm launched the final attack, massively deleting data from the logistics company’s computers.
READ ALSO
Security gaps in AI payment software left digital wallets open
ESET researchers have observed similar collaborations in the past, where the first team leads the way and delivers ready-made targets to Sandworm, targeting critical sectors in Ukraine such as government, energy, and transportation.
G
Hacks.gr on Google
Set it as a preferred source for cybersecurity updates.
Preferred source
Top comments (0)