Two Russian Hacking Groups Joined Forces to Wipe Data at a Ukrainian Grain Company

Researchers at Slovak cybersecurity firm ESET have detailed a destructive attack on an unnamed Ukrainian grain logistics company that involved two Russian-linked groups working together. The intrusion began in July 2025, when UAC-0099, a Russian-aligned espionage group, got into the company's systems through a phishing email with a malicious attachment. The attackers installed a backdoor called MatchWok to keep access, then deployed a previously unknown tool named MythicRatatoskr. It allowed them to run commands remotely, steal files and take screenshots.

ESET believes UAC-0099 later handed access to Sandworm, a group Western intelligence agencies link to Russia's military intelligence service, the GRU. Sandworm carried out a data-wiping attack in September, two months after the initial breach. ESET could not determine which group mainly operated the new backdoor. Researcher Anton Cherepanov said the tool had not been seen elsewhere, and that a Linux variant may also exist.

The attackers also hid their communications in an unusual way. Rather than connecting to a conventional server, the malware used Yggdrasil, a decentralized network that lets devices exchange encrypted data without a central hub. ESET said this is the first documented case of a state-aligned actor abusing Yggdrasil this way, and warned that such networks can make malicious infrastructure more resilient and harder to trace.