Research reportsESET Research

ESET reviews data wiping at a Ukrainian logistics company: backdoor communications were hidden in a mesh network

New ESET research reviews a 2025 compromise at a Ukrainian grain logistics company, with about two months between the malicious attachment and data wiping. The team analyses a backdoor using mesh-network communications. Distinguish the report's publication date from the actual incident date.

Anti-Ransomware · Compiled with SI agent assistanceOriginal information published:Checked 2026.10.26
Original synthetic illustration of grain warehouse staff maintaining logistics operations with paper delivery notes
Illustration · Source ↗ · About this image ↗

Source Facts

Research published by ESET on 22 October states that, according to its telemetry, the target was compromised through a malicious email attachment on 16 July 2025, followed by data wiping on 17 September. This is new analysis of an older incident, not a new disruption this month.

The research analyses a backdoor named MythicRatatoskr that communicates with its controller through the Yggdrasil mesh network. ESET assesses with high confidence that two groups handed over access, but has not determined which primarily operated the backdoor.

The case shows that initial compromise and destructive activity may be separated by time. After finding a suspicious attachment, investigate subsequent access, unusual outbound connections and privileged activity, and verify that isolated backups can be restored.

Next Steps for Businesses / Editorial Observations

An incident timeline should not end at the first suspicious email. Continued investigation can reveal preparations for later destructive activity.

Next steps you can take

  • Build a timeline from email, endpoint, network and identity logs to investigate anomalous access across devices.
  • Restrict unnecessary outbound connections and privileged changes, and rehearse restoration of important data and services from isolated backups.

Original sources

Reporting leads · The Hacker News

The original material listed above has been traced. Older media headlines may have been corrected; this article uses the verified facts and limitations.

MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration

Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.

This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.

Back to news ←

KEEP READING

Recommended reading

Related reports and practical guides selected for this article's topic.

Illustration of a female bakery owner checking online orders and receiptsIllustrationVulnerability advisories · 2026.10.25

PHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause

PHP / Palo Alto Networks Unit 42Original synthetic illustration of a software package conveyor and a master key stored separatelyIllustrationSupply chain security · 2026.10.24

LiteLLM explains package compromise: exposed keys must be revoked to complete the response

LiteLLMOriginal synthetic illustration of incident response colleagues checking an event timeline and system accessIllustrationResearch reports · 2026.10.23

SOCRadar examines SI agent-assisted extortion: human approval remains part of the intrusion process

SOCRadar Threat Research Unit