Sandworm Handed Access After MythicRatatoskr Deployed Over Yggdrasil in July 2025 Ukraine Logistics Wipe

The intrusion began with a spear-phish delivering MATCHBOIL, which fetched MATCHWOK and then MythicRatatoskr. The backdoor waited ten minutes before beaconing into the Yggdrasil overlay, enumerated directories, captured screenshots, and opened a SOCKS5 proxy for Sandworm operators. Two months later the same access path pushed SDelete via Active Directory, erasing data on systems supporting Ukrainian freight movement.

ESET telemetry shows MythicRatatoskr development between December 2024 and February 2025, with crond string references indicating a Linux counterpart exists. The Yggdrasil C2 choice is the first confirmed state-aligned use of the experimental mesh; prior Sandworm operations relied on conventional domains or compromised routers. The hand-off pattern matches earlier UAC-0099 transfers to Sandworm against energy and grain targets.

Logistics networks sit one hop from rail signaling and port scheduling systems; a successful wipe here directly delays fuel and food deliveries. The cooperation between initial-access brokers and destructive actors reduces attribution friction while increasing infrastructure resilience through peer-to-peer routing.

Defenders should monitor for Yggdrasil node traffic and Group Policy changes deploying SDelete or NikoWiper variants. Procurement records show continued Ukrainian investment in segmented OT networks, yet the mesh technique bypasses many perimeter controls now deployed.