The Russian state-linked hacking group Sandworm collaborated with another threat actor to carry out a destructive cyberattack against a Ukrainian grain logistics company last year, researchers said Thursday. The attack began in July 2025, when a Russian-aligned espionage group known as UAC-0099 gained access to the unnamed company’s systems through a phishing email containing a malicious attachment, according to a report by Slovak cybersecurity firm ESET. The hackers first installed a backdoor called MatchWok to maintain access to the company’s network. They later deployed a previously unknown tool, dubbed MythicRatatoskr, that allowed them to run commands remotely, steal files and take screenshots. “We have not seen MythicRatatoskr backdoor used anywhere else, and we found indications that a Linux variant may also exist,” said ESET researcher Anton Cherepanov, who investigated the attack. Researchers believe UAC-0099 subsequently handed over access to Sandworm, a group linked by Western intelligence agencies to Russia’s military intelligence service, the GRU. Sandworm carried out a data-wiping attack against the company two months later, in September. ESET said it could not determine which of the two groups primarily operated the newly discovered backdoor. The researchers also identified an unusual technique used by the attackers to conceal their communications with infected computers. Instead of connecting directly to a conventional server controlled by the hackers, the malware communicated through Yggdrasil, a decentralized network that allows devices to exchange encrypted data without relying on a central hub. “To our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor,” the researchers said, warning that such networks could make malicious infrastructure more resilient and harder to trace. UAC-0099, which has been active since at least 2022, has previously targeted Ukrainian government agencies, financial institutions, media outlets and companies in the transportation, manufacturing and energy sectors. Sandworm is among Russia’s most notorious state-backed hacking groups, known for targeting critical infrastructure and carrying out destructive operations against Ukraine. The group was linked to cyberattacks that caused power outages in Ukraine in 2015 and 2016, as well as an attempted attack on the country’s energy infrastructure in 2022. Since Russia launched its full-scale invasion of Ukraine, Sandworm has repeatedly used data-wiping malware against Ukrainian organizations. Unlike ransomware, which typically encrypts files to demand payment, such malware is designed to permanently destroy data and disrupt operations. In a report published last November, ESET said Sandworm had launched multiple destructive attacks against Ukrainian organizations in the grain, energy, logistics and government sectors between June and September 2025. Although Ukrainian infrastructure has faced frequent cyberattacks throughout the war, direct attacks on agricultural businesses had been relatively uncommon, researchers said. ESET’s findings are another example of cooperation between Russian hacking groups. Earlier in 2025, the firm identified four cases in which two Russia-linked espionage groups, Gamaredon and Turla, both associated with Russia’s Federal Security Service, targeted the same Ukrainian organizations. “A UAC-0099-to-Sandworm handoff is unusual in the specific actors involved, but no longer surprising as a pattern,” researchers said.
Click Here For The Original Source.
——————————————————–
