Two Russian-linked groups wipe data at Ukrainian grain logistics firm

ESET reported that two Russian-linked groups attacked a Ukrainian grain logistics company one after another, and the second group wiped data from affected computers. The victim has not been publicly identified, and the published research does not state the number of systems affected, financial loss, or any ransom demand.

The intrusion began on July 16, 2025, when a phishing email with a malicious attachment reached the victim, according to the research. The attackers then deployed the MATCHWOK backdoor through a downloader called MATCHBOIL, and one day later deployed a previously undocumented backdoor named MythicRatatoskr. The backdoor gave the operators remote command execution, file browsing, screenshot capture, and a reverse SOCKS5 proxy.

ESET said the backdoor's command traffic went to a server inside the Yggdrasil mesh network, which is run by volunteers and has no central owner. According to ESET, no state-aligned group had previously been documented using Yggdrasil this way. Researcher Peter Strýček explained that MythicRatatoskr is named after the squirrel in Norse mythology that carries messages along the world tree Yggdrasil.

The destructive phase came on September 17, 2025, roughly nine weeks after the first access. By then, the attackers had gained administrator privileges and used Microsoft's legitimate SDelete utility to wipe data from affected machines. ESET said SDelete was dropped via Active Directory Group Policy. The roughly nine-week gap between first access and the wipe is longer than many security teams would expect to detect and interrupt a persistent intruder, according to Tech Insider's analysis. The reports do not state whether data was stolen during that period.

ESET assessed that UAC-0099 gained the initial foothold and then passed that access to Sandworm, which performed the wipe. However, for the period between first access and the data wipe, the researchers could not tell which of the two groups was running MythicRatatoskr. Western intelligence agencies and researchers widely connect Sandworm to Russia's GRU.

The phishing email arrived during a wider campaign that targeted government, energy, logistics, and grain sectors in Ukraine, according to an ESET APT activity report covering Q2 2025 through Q3 2025. ESET told The Hacker News that the MythicRatatoskr intrusion was one of those attacks.

Defenders should look for unauthorized Yggdrasil or other mesh software on endpoints and servers, watch for new virtual network adapters that open encrypted peer links, tighten email attachment policies, limit outbound network destinations, enable process creation logging, restrict administrator rights, and keep offline backups that domain accounts cannot alter.