Threat feed

MythicRatatoskr Yggdrasil C2

MythicRatatoskr: Yggdrasil-mesh C2 backdoor in UAC-0099/Sandworm Ukraine wiper operation

Posted · Updated · Spectrum Delta Research Team

Summary

ESET (Oct 22) documents MythicRatatoskr, a previously unknown Go backdoor that hides its C2 server inside the decentralized Yggdrasil mesh network — the first documented state-aligned use of Yggdrasil for C2. UAC-0099 gained initial access to a Ukrainian grain logistics firm via spearphishing (MATCHBOIL/MATCHWOK chain); MythicRatatoskr appeared the next day, and after an assessed access handoff Sandworm conducted a data-wiping attack two months later by deploying SDelete through Active Directory Group Policy.

Breakdown

Adversary

UAC-0099

Procedures (6)

  1. Scheduled task pdfopentask executes PowerShell payload

    Logs

    • Windows System/Security event logs · Service installs (7045); Task Scheduler operational events; 4698 task creation
    • Sysmon / EDR · Process creation (schtasks, reg.exe, sdelete); file/registry events; EID 3

    Detectors

    No known detector

Click to expand remaining (5) procedures

  1. Run-key persistence (UpdateMonitor) for MATCHWOK backdoor

    Run-key persistence for MATCHWOK

    • T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

    Logs

    • Sysmon / EDR · Process creation (schtasks, reg.exe, sdelete); file/registry events; EID 3

    Detectors

    No known detector

  2. MythicRatatoskr installed as Windows service ieupdate

    • T1543.003Create or Modify System Process: Windows Service

    Logs

    • Windows System/Security event logs · Service installs (7045); Task Scheduler operational events; 4698 task creation

    Detectors

    No known detector

  3. Dot-prefixed encrypted config files (.updatecache/.crond)

    Dot-prefixed encrypted configuration files

    • T1027.013Obfuscated Files or Information: Encrypted/Encoded File

    Logs

    • Sysmon / EDR · Process creation (schtasks, reg.exe, sdelete); file/registry events; EID 3

    Detectors

    No known detector

  4. Yggdrasil mesh connections to random public peers (HTTPS C2)

    Yggdrasil mesh connections to public peers (HTTPS C2)

    • T1090.003Proxy: Multi-hop Proxy

    Logs

    • Network / proxy / firewall · Public-peer connections (TLS/QUIC/TCP); inner C2 not presumed visible
    • Sysmon / EDR · Process creation (schtasks, reg.exe, sdelete); file/registry events; EID 3

    Detectors

    No known detector

  5. SDelete endpoint execution for data wiping

    SDelete execution for data wiping (GPO-distributed)

    Logs

    • Sysmon / EDR · Process creation (schtasks, reg.exe, sdelete); file/registry events; EID 3

    Detectors

    • Sigma: SDelete file overwrite · a4824fca (test): OriginalFileName sdelete.exe, no help/clean/zero flags

Indicators of compromise

Hunt only

12 SHA-1 hash rows for MythicRatatoskr samples (Act64.exe, ie.exe, ieupdate.exe x3, krbtman.exe, OneDriveLiveUpdater.exe, windowsdefendersvc.exe x2, updater.exe) and SOCKS5 server binaries (krbtman.exe, nbtresolver.exe); the WinGo/Agent.ZO, WinGo/Agent.AOK, WinGo/TrojanProxy.Agent.I labels are ESET file/sample detections (sample coverage, not behavioral coverage); MATCHWOK C2 uztickets[.]com; MATCHBOIL download egyptanimals[.]com/animals/photoalbum; Yggdrasil C2 201:b479:2771:8df4:b5eb:d007:63b0[:]2838 (HTTPS 443) and proxy port 8080; 32 public Yggdrasil peers in TLS, QUIC and TCP forms (full list in the ESET report, e.g. tls://37.205.14[.]171:993, g.ygg[.]yt:443); service name ieupdate; Run value UpdateMonitor; task name pdfopentask; config paths .updatecache/.crond; SOCKS5 on 127.0.0.1:33690. Single-origin (ESET); public peers are shared infrastructure (false-positive prone) — assessed 2026-10-24, hunt-only.

Sources

Grades are source reliability (A–F) and information credibility (1–6).

Questions, detections or sightings of MythicRatatoskr Yggdrasil C2? Bring them to the community.

Discuss in the Tradecraft Slack