Sandworm and UAC-0099 Collaborate on Destructive Cyberattack Against Ukrainian Grain Firm
Russian state-linked hackers Sandworm and UAC-0099 joined forces to wipe data at a Ukrainian grain logistics company, employing novel techniques including decentralized network communication.
The Russian state-linked hacking group Sandworm, notorious for its destructive operations, collaborated with another threat actor, UAC-0099, to execute a significant data-wiping cyberattack against an unnamed Ukrainian grain logistics company. The attack, which began in July 2025, saw UAC-0099 gain initial access through a phishing email containing a malicious attachment. This allowed them to install a backdoor known as MatchWok, ensuring persistent access to the company's network.
Following the initial compromise, UAC-0099 deployed a previously undiscovered tool, dubbed MythicRatatoskr. This sophisticated malware enabled the attackers to execute remote commands, exfiltrate sensitive files, and capture screenshots of the victim's systems. Researchers noted that MythicRatatoskr had not been observed in other campaigns, and evidence suggested a potential Linux variant might also exist, indicating a developing toolset.
ESET researchers believe that UAC-0099 subsequently handed over access to Sandworm, a group directly linked by Western intelligence agencies to Russia's military intelligence service, the GRU. Sandworm then initiated a data-wiping operation in September 2025, two months after the initial intrusion. The exact division of labor between the two groups regarding the deployment and operation of the MythicRatatoskr backdoor remains unclear.
Adding a layer of technical sophistication, the attackers utilized Yggdrasil, a decentralized network, to mask their command-and-control communications. Instead of relying on traditional, traceable servers, the malware communicated through this encrypted, peer-to-peer network. This marks one of the first documented instances of a state-aligned threat actor abusing such decentralized infrastructure, making malicious activity harder to detect and disrupt.
UAC-0099 has been an active threat since at least 2022, with a history of targeting Ukrainian government entities, financial institutions, media, and critical sectors like transportation, manufacturing, and energy. Sandworm, on the other hand, is one of Russia's most prominent state-backed groups, recognized for its disruptive attacks on Ukraine's critical infrastructure, including past power grid disruptions.
Since Russia's full-scale invasion of Ukraine, Sandworm has frequently employed data-wiping malware, distinguishing its operations from ransomware by focusing on permanent data destruction and operational disruption rather than financial gain. ESET's report highlighted that Sandworm had conducted multiple such attacks against Ukrainian organizations in the grain, energy, logistics, and government sectors between June and September 2025.
While cyberattacks against Ukrainian infrastructure have been a constant throughout the war, direct targeting of agricultural businesses had been less common until recently. This incident underscores the evolving tactics and expanding targets within the ongoing cyber warfare.
The collaboration between UAC-0099 and Sandworm, while unusual in the specific actors involved, aligns with a broader observed pattern of Russian-linked espionage groups cooperating to achieve strategic objectives against Ukraine.