hacker-news · Crawled Oct 24, 2026
Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
3 IoCs 2 Actors
Read original article ↗
AI Summary
Russia-linked threat actor UAC-0099, also known as Earth Sirrush, conducted a spear-phishing attack against a Ukrainian logistics company in July 2025, deploying the MATCHBOIL downloader and subsequently the MATCHWOK backdoor. A novel backdoor named MythicRatatoskr was deployed, which communicates via the Yggdrasil mesh network, enabling stealthy command-and-control. UAC-0099 later handed access to Sandworm, which executed a destructive data-wiping attack in September 2025 using SDelete distributed via Group Policy, highlighting collaboration between Russian-aligned groups.
AI-extracted · verify before operational use
Extracted Entities 2 found
Indicators of Compromise 3 extracted
MITRE ATT&CK TTPs 43 techniques
T1053.005 Scheduled Task · Execution T1059.001 PowerShell · Execution T1071.001 Web Protocols · Command And Control T1090 Proxy · Command And Control T1095 Non-Application Layer Protocol · Command And Control T1105 Ingress Tool Transfer · Command And Control T1110 Brute Force · Credential Access T1204.002 Malicious File · Execution T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access T1003 OS Credential Dumping · Credential Access T1012 Query Registry · Discovery T1016 System Network Configuration Discovery · Discovery T1021 Remote Services · Lateral Movement T1021.001 Remote Desktop Protocol · Lateral Movement T1027 Obfuscated Files or Information · Defense Evasion T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol · Exfiltration T1055 Process Injection · Defense Evasion T1057 Process Discovery · Discovery T1059.003 Windows Command Shell · Execution T1069.002 Domain Groups · Discovery T1070.001 Clear Windows Event Logs · Defense Evasion T1070.004 File Deletion · Defense Evasion T1071 Application Layer Protocol · Command And Control T1071.004 DNS · Command And Control T1078 Valid Accounts · Defense Evasion T1078.004 Cloud Accounts · Defense Evasion T1081 T1081 T1082 System Information Discovery · Discovery T1083 File and Directory Discovery · Discovery T1087.002 Domain Account · Discovery T1090.002 External Proxy · Command And Control T1098 Account Manipulation · Persistence T1120 Peripheral Device Discovery · Discovery T1129 Shared Modules · Execution T1133 External Remote Services · Persistence T1136.002 Domain Account · Persistence T1210 Exploitation of Remote Services · Lateral Movement T1217 Browser Information Discovery · Discovery T1485 Data Destruction · Impact T1486 Data Encrypted for Impact · Impact T1490 Inhibit System Recovery · Impact T1558 Steal or Forge Kerberos Tickets · Credential Access