ESET discloses mesh backdoor in Ukraine wiper attack

ESET reported that UAC-0099 gained initial access to a Ukrainian grain logistics company on July 16, 2025, through a spear-phishing email carrying a malicious attachment, then handed access to Sandworm, which conducted a data-wiping attack on September 17, 2025.

On the morning of July 16, 2025, at 06:59, a scheduled task named pdfopentask executed on one machine and ran a PowerShell payload from %temp%\temporarydoc.txt. One minute later, MATCHBOIL was deployed and installed the MATCHWOK backdoor from https://egyptanimals[.]com/animals/photoalbum, using command server https://uztickets[.]com. Additional MythicRatatoskr samples reached other machines through an OpenSSH SFTP server, and ESET observed a SOCKS5 server on compromised machines, including one sample pulled from an unknown archive with WinRAR.

UAC-0099 has been active since at least 2022 and was first reported by CERT-UA in June 2023. ESET assesses with medium confidence that the group is aligned with Russian interests based on its targeting of Ukrainian organizations, and assesses that it can act as an initial access broker for Sandworm. ESET attributed the initial access phase to UAC-0099 with high confidence based on the MATCHBOIL downloader and MATCHWOK backdoor. Beyond MATCHBOIL, UAC-0099 typically deploys LONEPAGE, a PowerShell downloader named after the word page in its command server addresses, and the group targets governmental organizations, financial institutions, and media in Ukraine.

Sandworm is attributed to GRU Unit 74455, and ESET attributed the data-wiping activity in this intrusion to Sandworm with high confidence based on the group’s tactics, techniques, and procedures. The group is known for attacks against Ukrainian energy companies in December 2015 and December 2016 that caused power outages, and it launched the NotPetya data-wiping attack in June 2017 using a supply-chain vector by compromising Ukrainian accounting software M.E.Doc. The US Department of Justice published an indictment in October 2020 against six Russian computer hackers alleged to have prepared and conducted various Sandworm attacks.

MythicRatatoskr is a previously undocumented Go-based backdoor that uses a command-and-control server located within the Yggdrasil mesh network. Yggdrasil is a decentralized mesh network implementing an experimental routing scheme with end-to-end protected IPv6 communication between nodes. ESET said this represents the first documented instance of Yggdrasil being misused by a state-aligned threat actor, with researchers Anton Cherepanov and Peter Strýček stating, “To our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor”. The backdoor sends victim metadata to the command server, polls for new commands, transmits command output, takes screenshots, and uploads or downloads files; during check-in it sends information about the current user, hostname, and local network settings, and operators can exfiltrate files and screenshots to the command server through HTTPS routed over the Yggdrasil mesh network without staging data first.

Binaries show signs suggesting development started between December 2024 and February 2025. Some samples include a 10-minute startup delay likely intended to avoid immediately connecting to the Yggdrasil network and evade detection, and the backdoor is started as a Windows service named ieupdate. Source code references to crond and a configuration path using forward slashes indicate a Linux variant may also exist. ESET has not seen the backdoor used anywhere else outside this intrusion.

CERT-UA documented MATCHBOIL in August 2025, and compilation timestamps in those samples point to mid-2024, meaning the tool likely operated for about a year before publication; ESET believes, based on compilation timestamps, that it could have been in development since April 2024. ESET analyzed MATCHBOIL samples from April 2024 to April 2026, with the earliest versions from April 2024 and the latest from April 2026, and earlier samples compiled or seen before November 2025 were much more straightforward and simpler to analyze than newer versions. Later versions use the Eziriz .NET Reactor commercial obfuscator, and all MATCHBOIL victims observed in ESET telemetry were in Ukraine across various sectors.

MATCHBOIL is distributed through malicious links in spear-phishing e-mails that download an archive containing a VBScript file. From July to August 2025, ESET saw MATCHBOIL samples at multiple transportation companies. In December 2025, ESET saw samples at a manufacturing company, and in June 2026, ESET telemetry registered samples at a company in the energy sector. “The malware is distributed via malicious links in spear phishing emails”, said Fernando Tavella, ESET researcher.

MATCHBOIL changed from a single-use downloader into a dropper that repeatedly retrieves updated payloads from its server; by late 2025 it executed every two minutes. Newer versions include sandbox checks and a less conspicuous interface to avoid detection, and late 2025 builds display a decoy window titled Dairy containing a daily planner and a cat photo when launched manually. MATCHBOIL records each machine’s CPU ID and BIOS serial number, then contacts the operator’s server with three HTTPS requests, and scans Windows event logs for uptime recorded in English or Russian. To avoid sandbox detection, MATCHBOIL treats the absence of at least three uptime events of 7,200 seconds or more as evidence of a sandbox, and the April 2026 version added a check confirming the operating system was installed at least ten days before the malware runs.

The payload hiding location changed over time, from DeviceMonitor in 2024 to MeowMeowProgramm.exe in MeowCheck by late 2025 and SMTPClientApplication.exe in SMTPClient by April 2026. MATCHBOIL extracts a payload hidden as hex-encoded text inside an HTML response from its server, writes the payload to a folder under %LOCALAPPDATA%, and configures it to relaunch through a scheduled task or Windows registry key. If the target folder already exists, MATCHBOIL exits, and MATCHBOIL also checks for a specific directory on the victim machine and terminates if that directory already exists. Initial versions used both a registry value and a scheduled task for persistence before later versions switched exclusively to the Windows Run key and then returned to scheduled tasks.

UAC-0099 uses virtual private servers such as BitLaunch to host command servers and cloud services such as Cloudflare to hide them; these servers use HTTP and HTTPS. ESET found that UAC-0099’s Let’s Encrypt certificates are not reused across domains. ESET researcher Fernando Tavella said UAC-0099’s expansion into transportation, manufacturing, and energy victims could mean the group seeks to maximize its impact in Ukraine and may target organizations useful to other advanced persistent threat groups.

ESET assesses with high confidence that UAC-0099 handed off access to Sandworm during the intrusion, though researchers could not determine which group primarily operated the MythicRatatoskr backdoor. The intrusion investigated by ESET compromised a Windows system, and the attackers deployed a standalone SOCKS5 server internally named bindProxy during August 2025 activity, possibly because the backdoor’s proxy command did not work as expected. MATCHBOIL persists MATCHWOK by adding the registry value UpdateMonitor to the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\.

The data-wiping attack used standard Sandworm tactics observed numerous times in ESET telemetry. Sandworm-linked NikoWiper malware is derived from SDelete, and unlike ransomware, data-wiping malware is designed to permanently destroy data and disrupt operations.

Earlier in 2025, ESET identified that Russia-aligned Gamaredon collaborated with Turla, another Russia-aligned threat actor linked to Russia’s Federal Security Service, and ESET identified four cases in which Gamaredon and Turla targeted the same Ukrainian organizations. One intrusion leveraged Gamaredon’s PteroGraphin to deploy Turla’s Kazuar backdoor, and a Gamaredon-linked downloader called Pterodo has been used to retrieve and execute InvisiMole, a modular spyware program used against targets in Ukraine and Russia.

ESET’s APT Activity Report Q2 2025–Q3 2025 said UAC-0099 conducted initial access operations and transferred validated targets to Sandworm for further post-exploitation, and those earlier operations targeted government, energy, logistics, and grain sectors in Ukraine. ESET confirmed that the MythicRatatoskr case was among the attacks described in that report. Direct attacks on agricultural businesses had been relatively uncommon in the context of Ukrainian infrastructure cyber attacks.

ESET reported in November 2025 that Sandworm launched multiple destructive attacks against Ukrainian organizations in grain, energy, logistics, and government sectors between June and September 2025. Since Russia’s full-scale invasion of Ukraine, Sandworm has repeatedly used data-wiping malware against Ukrainian organizations. ESET researchers warned that adversaries adopting experimental peer-to-peer networks may increase the resilience and stealth of their infrastructure. ESET researchers presented findings on MythicRatatoskr at LABScon on September 18, 2026, and at the Virus Bulletin conference on October 16, 2026.