MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
2026-10-23T20:51:31Z•ebe9854dd6015eaef628bf0d2d815ed234bb1b048f1d0b16daff7f65fa36b499
APTEDR evasionGo malwareMATCHBOILMythicRatatoskrOT securitySandwormUAC-0099UEFI Secure BootUkraineUkrainian grain sectorYggdrasilbackdoorcommand-and-controlcyber espionagedestructive attackinfostealermalwarephishingquishingransomwaresupply chain
What happened
ESET reports on MythicRatatoskr, a previously unknown Go-based backdoor associated with a UAC-0099 and Sandworm collaboration. The malware conceals command-and-control infrastructure within the Yggdrasil mesh network and reportedly enabled a destructive attack against a Ukrainian grain company. The feed also covers related UAC-0099 activity, including the MATCHBOIL downloader, as well as broader phishing, scams, APT, ransomware, infostealer, OT, and supply-chain threats.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- eset_welivesecurity
- Record identifier
- ebe9854dd6015eaef628bf0d2d815ed234bb1b048f1d0b16daff7f65fa36b499
- Enrichment time
- 2026-10-23T20:51:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.