As reported by The Hacker News, ESET researchers have documented a striking 2025 operation in which the Russia-aligned UAC-0099 (Earth Sirrush) group handed off access to Sandworm for a destructive wiper attack against a Ukrainian logistics firm. The operation's most novel element — a backdoor dubbed MythicRatatoskr that uses the Yggdrasil mesh network for command-and-control — deserves close scrutiny, because it points to where state-sponsored infrastructure is heading.
Why Yggdrasil Changes the Defensive Equation
Yggdrasil is a legitimate, encrypted peer-to-peer mesh routing protocol with a decentralized IPv6 overlay. Its appeal to a threat actor is structural: there is no single C2 server to block, no static IP to denylist, and traffic blends into a growing legitimate user base. Traditional egress controls — proxy logs, sinkhole domains, known-bad IP feeds — are largely blind to this traffic. Once a node joins the mesh, an operator can issue commands from a peer that rotates address space and is effectively untraceable without deep protocol-level visibility.
This is the first documented abuse of Yggdrasil by a state-aligned actor, but it is unlikely to be the last. Decentralized transport is a natural evolutionary answer to increasingly effective perimeter and threat-intel-driven defenses.
The Two-Month Dwell Window
The timeline is itself instructive. Initial access via spear-phishing occurred on July 16, 2025; the wiper landed September 17. That is roughly two months of persistent presence — long enough for credential theft, AD reconnaissance, and lateral movement, but short enough that the objective was clearly kinetic rather than espionage. The 10-minute startup delay built into MythicRatatoskr is a telling operational detail: it is designed to defeat sandbox detonation and break automated analysis pipelines that time out within minutes.
Access-as-a-Service Within Aligned Ecosystems
The UAC-0099 → Sandworm handoff is not novel in itself, but it is becoming institutionalized. ESET's prior reporting already flagged this collaboration pattern, and the division of labor — phishing specialist obtains foothold, wiper specialist executes terminal effect — mirrors the kind of specialization we see in cybercrime ecosystems. The implication for defenders is that attribution by initial-access TTPs can no longer be conflated with the final-stage actor. A spear-phishing investigation must assume downstream destructive potential even when the dropper appears credential-focused.
SDelete via Group Policy: An Underappreciated Kill Chain
Sandworm delivered the wiper via Active Directory Group Policy, using Sysinternals SDelete — a legitimate signed Microsoft utility. This is the same lineage that produced NikoWiper. The technique is significant because it weaponizes the very trust infrastructure defenders rely on: a single compromised Domain Controller becomes the delivery mechanism for organization-wide destruction. No exotic malware is required; the destruction is performed by a tool that ships from Microsoft.
Shield53 Recommendations
sdelete.exe, multi-pass overwrite flags (-p), and any deletion tool invoked from a GPO-distributed path or network share.The broader signal here is infrastructure agility. State-aligned groups are moving away from static infrastructure toward decentralized, signed-tool-laden, trust-weaponizing tradecraft. The defenses that worked against 2022-era Sandworm will not reliably detect 2025-era Sandworm — and the gap will widen.
