MYTHICRATATOSKRMythicRatatoskr

Windows backdoor written in Go, reported by ESET as deployed on July 17th, 2025 at a Ukrainian grain logistics company, one day after UAC-0099 gained initial access through the MATCHBOIL/MATCHWOK chain and two months before Sandworm wiped data there with SDelete pushed through Active Directory Group Policy. Built on yggstack, it joins the public Yggdrasil mesh network through three peers picked from an embedded list of 32 and reaches a C&C server hosted inside that network over HTTPS (JSON messages checkin, tasking, result, getfile). It runs as the ieupdate Windows service, keeps an AES-256-CFB encrypted configuration in dot-files such as C:\Windows\Temp\.updatecache, and supports shell execution, file transfer, screenshots, directory navigation, exposing local TCP ports over Yggdrasil and a reverse SOCKS5 proxy derived from revsocks. A .crond configuration path suggests a Linux variant. ESET could not determine whether it was operated primarily by UAC-0099 or by Sandworm.