GRU hackers used new technology in cyberattack against Ukraine

ESET cybersecurity experts have identified a previously unknown MythicRatatoskr backdoor, which was used in a sophisticated, coordinated attack by the UAC-0099 and Sandworm groups (Unit 74455 of Russia’s GRU) against a Ukrainian grain-sector logistics company. Source: Welivesecurity

The corporate network was breached in July 2025 through a phishing email with a malicious attachment that launched the MATCHBOIL downloader and MATCHWOK backdoor. The very next day, the attackers deployed the Go-based MythicRatatoskr malware on targeted machines to establish persistence and conduct reconnaissance.

What makes this tool unique is its use of the decentralized Yggdrasil mesh network to communicate covertly with its command-and-control (C&C) server. By routing encrypted IPv6 traffic through public network nodes, the malware successfully evaded traditional network activity monitoring tools.

The hackers later used an additional SOCKS5 server and a proxying tool to move deeper into the company’s local network. In September 2025, the UAC-0099 group handed over its access to Sandworm hackers, who carried out the operation’s final phase, completely destroying the company’s data with the SDelete utility and Active Directory Group Policy.

ESET analysts emphasize that this is the first documented case of pro-government hacking groups abusing the experimental Yggdrasil network. This tactic points to the evolving methods of Russian cyber units, which are increasingly using unconventional protocols to make their infrastructure more resilient and covertly destroy critical data.

Earlier, GRU hackers breached defense contractors in two NATO-allied countries.