A handoff inside one compromised network
ESET’s October 22 research describes a Ukrainian grain logistics company where an intrusion attributed to UAC-0099 preceded destructive activity attributed to Sandworm. The events occurred in 2025: initial access on July 16, followed by a data-wiping operation on September 17. The newly published analysis concerns that historical operation, rather than a newly reported October attack.
An unusual communications route
Researchers identified a previously undocumented backdoor, MythicRatatoskr, which used the Yggdrasil mesh network to reach its command server. ESET assesses with high confidence that access passed between the two groups, but cannot determine which principally operated the backdoor. It had not observed the malware elsewhere. The report attributes the eventual destruction to deployment of SDelete through Active Directory Group Policy. These are ESET’s findings and assessments, not independently confirmed attribution by this publication.
Investigate the whole period of access
For transportation security teams, the central operational lesson is the gap between discovering an entry point and establishing the limits of an intrusion. Our analysis is that a response organized only around the first detected malware can miss a change in purpose. A case initially treated as information theft may require a separate assessment of destructive access to shared infrastructure. The investigation should connect endpoint evidence, privileged-account activity and changes in centrally managed policy across the available timeline. Where retention leaves gaps, the incident record should explain them rather than infer inactivity.
Tie recovery to dispatch operations
A logistics exercise can make that distinction concrete without reproducing the attack. Ask which applications and records dispatchers would need if centrally managed Windows systems became unavailable, which teams can authorize an alternate workflow and how restored information would be reconciled. Include the identity services needed to access recovery systems, not just copies of business files. Those are proposed planning questions, not reported effects at the unnamed victim. The exercise should produce an order of restoration agreed by operations and security, with dependencies that can actually be tested. That makes the research useful beyond a malware name while avoiding the unsupported conclusion that every logistics operator faces this particular campaign. ESET’s technical report supplies indicators for an evidence-led review; a match still needs context and validation.
Sources & further reading
Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.
