The Russian state-sponsored hacking group Sandworm, in collaboration with UAC-0099, executed a destructive attack on a Ukrainian logistics company in 2025, using a newly developed backdoor called MythicRatatoskr.
The vulnerability or weakness
The attack involved the use of a previously undocumented backdoor, MythicRatatoskr, which communicated with a command-and-control server hosted inside the Yggdrasil mesh network.
Earlier attacks and coverage
- China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack (2026-10-22)
- LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor (2026-10-21)
- Hackers Hid Vasilek Backdoor in VMware Tools During 2-Year Russian Healthcare Intrusion (2026-10-21)
- Hackers Abuse AI Pen-Test Tool Cairn to Automate Massive Attack Spree (2026-10-20)
- Hackers Exploit Plex2Shell Flaws to Install Crypto Miners and Linux Proxy Backdoor (2026-10-19)
Business impact
The data-wiping attack disrupted operations and potentially caused significant financial losses for the Ukrainian logistics company, impacting its business continuity and operational efficiency.
Industries affected
The incident primarily affects the logistics and transportation sector, given the targeted nature of the attack on a logistics company.
Users affected
Customers and employees of the affected company faced potential data loss and operational disruptions, affecting their daily operations and trust in the company's security measures.
