A destructive data-wiping attack against a Ukrainian logistics company was carried out through a strategic partnership between the Russian state-sponsored group Sandworm and another threat actor, as first reported by The Hacker News.
The operation began July 16, 2025, when the threat actor UAC-0099 gained initial access via a spear-phishing email. The attackers deployed a previously undocumented backdoor named MythicRatatoskr, which utilizes the Yggdrasil mesh network for command-and-control communications. This backdoor allows for file exfiltration, screenshot capture and the deployment of reverse SOCKS5 proxies. Researchers at ESET noted that this is the first documented instance of Yggdrasil being leveraged by a state-aligned actor to enhance infrastructure stealth. After establishing a foothold, UAC-0099 transferred access to Sandworm. On Sept. 17, 2025, Sandworm executed a data-wiping attack by deploying the SDelete utility through Active Directory Group Policy. This collaboration highlights a growing trend of Russian-aligned groups sharing validated targets to amplify the impact of their espionage and sabotage campaigns. While the current investigation focused on Windows systems, evidence suggests a Linux variant of the malware may exist. The incident underscores the increasing sophistication and coordination among threat actors targeting critical infrastructure in Ukraine.
Source: The Hacker News
