Rossiya davlat homiyligidagi Sandworm xakerlar guruhi o‘tgan yili Ukrainadagi logistika kompaniyasiga qarshi halokatli o‘chirish hujumini amalga oshirish uchun boshqa tahdid aktori bilan hamkorlik qildi.
ESET ma’lumotlariga ko‘ra, hujum UAC-0099 (aka Earth Sirrush) 2025-yil 16-iyulda nishonga dastlabki kirishni zararli ilova bilan biriktirilgan spear-phishing elektron pochtasi orqali amalga oshirgan. Bu MATCHBOIL deb nomlangan yuklovchi orqali MATCHWOK orqa eshigi joylashtirilishiga olib kelgan.
Faoliyat yakunida tahdid aktori kirishni Sandwormga topshirgan, u esa 2025-yil 17-sentabrda — tizimga kirganidan ikki oydan ortiq vaqt o‘tib — ma’lumotlarni o‘chirish hujumini o‘tkazgan.
Hujumni ajratib turadigan jihat — UAC-0099 avval hujjatlashtirilmagan MythicRatatoskr deb nomlangan orqa eshikdan foydalangani. U Yggdrasil mesh-tarmog‘i ichida joylashgan buyruq va nazorat (C2) serveri bilan aloqa qiladi. Orqa eshik MATCHWOK ishga tushirilganidan bir kun o‘tib joylashtirilgan.
Orqa eshikni ishlab chiqish 2024-yil dekabr va 2025-yil fevral o‘rtasida boshlanganiga ishoralar bor. Uning funksionalligi juda sodda: u jabrlanuvchi metama’lumotlarini C2 serveriga yuboradi, yangi buyruqlarni so‘raydi, buyruq natijasini uzatadi, skrinshot oladi va fayllarni yuklaydi/yuklab oladi.
Shuningdek, u joriy ishchi katalogni o‘zgartirishi, katalog mazmunini ro‘yxatga olishi, C2 server URL manzilini o‘zgartirishi, "cmd.exe" orqali shell buyrug‘ini bajarishi va teskari SOCKS5 proksi-serverini ishga tushirishi mumkin. Bundan tashqari, ba’zi artefaktlarda 10 daqiqalik ishga tushirish kechikishi mavjud — bu Yggdrasil tarmog‘iga darhol ulanmaslik va aniqlanishdan qochish maqsadida qilingan.
"Bizning ma’lumotimizcha, bu davlat bilan bog‘liq tahdid aktori tomonidan Yggdrasil shu tarzda suiiste’mol qilingan birinchi hujjatlashtirilgan holat bo‘lib, bu dushmanlar tajribaviy peer-to-peer tarmoqlarini o‘z infratuzilmasining chidamliligi va yashirinligini oshirish uchun qabul qilishi kengroq tendensiya boshlanishi mumkinligini ko‘rsatadi", — deb aytishdi ESET tadqiqotchilari Anton Cherepanov va Peter Strýček.
MythicRatatoskr buzilgan tarmoq orqali ulanishlarni yo‘naltirish uchun SOCKS5 serverini joylashtirishda ishlatilgan. Hujum yakunida Sandworm Active Directory Group Policy orqali SDelete yordam dasturini tarqatib, ma’lumotlarni o‘chirish hujumini amalga oshirgan. Ta’kidlash joizki, Sandworm bilan bog‘liq NikoWiper zararli dasturi ham SDelete’dan kelib chiqqan.
Yggdrasil xaritasi C&C serveri bilan
ESET tekshirgan hujum Windows muhitini buzgan bo‘lsa-da, MythicRatatoskr manba kodidagi "crond" ga havolalar zararli dasturining Linux versiyasi ham mavjud bo‘lishi mumkinligini ko‘rsatadi.
UAC-0099 Sandworm bilan hamkorlik qilayotgani haqidagi baholash yangi emas. ESET o‘zining APT Activity Report Q2 2025–Q3 2025 hisobotida UAC-0099 dastlabki kirish operatsiyalarini o‘tkazib, keyin "tasdiqlangan nishonlar"ni Sandwormga keyingi post-ekspluatatsiya uchun topshirganini kuzatganini aytgan.
Bu hujumlar Ukrainadagi davlat, energetika, logistika va don sektorlari nishoniga qaratilgan, deb ta’kidlagan Slovakiya kiberxavfsizlik kompaniyasi o‘sha paytda. ESET The Hacker News nashriga MythicRatatoskr holati o‘sha hujumlar qatorida ekanligini tasdiqlagan.
Rossiya bilan bog‘liq aktorlar o‘rtasidagi bunday hamkorlik ham yangi emas. O‘tgan yili ESET Gamaredon va Turla birgalikda Ukrainadagi tashkilotlarga hujum qilish va birgalikda buzish uchun ishlaganini aniqlagan — bir kirishda Gamaredonning PteroGraphin dasturi Turla’ning Kazuar orqa eshigini joylashtirish uchun ishlatilgan.
Bundan tashqari, Gamaredon bilan bog‘liq Pterodo deb nomlangan yuklovchi InvisiMole — Ukrainada va Rossiyada nishonlarga qarshi ishlatilgan modulli josuslik dasturini olish va ishga tushirish uchun ishlatilgan.
"Bunday hamkorlik Rossiya bilan bog‘liq guruhlar o‘rtasida muvofiqlashtirilgan kiberjosuslik kampaniyalarining salohiyatini ta’kidlaydi, bu ehtimol ularning operatsion ta’sirini kuchaytirish maqsadida qilingan", — deb aytgan ESET.
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.
According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of the MATCHWOK backdoor through a downloader called MATCHBOIL.
The activity ultimately concluded with the threat actor handing off access to Sandworm, which then conducted a data-wiping attack on September 17, 2025, more than two months after it obtained a foothold.
What makes the attack stand out is UAC-0099's use of a previously undocumented backdoor called MythicRatatoskr that communicates with a command-and-control (C2) server hosted inside the Yggdrasil mesh network. The backdoor was deployed a day after MATCHWOK was executed.
There are indications that development on the backdoor started sometime between December 2024 and February 2025. Its functionality is fairly straightforward in that it sends victim metadata to the C2 server, polls for new commands, transmits command output, takes screenshots, and uploads/downloads files.
It can also alter the current working directory, enumerate directory contents, change the C2 server URL, execute a shell command via "cmd.exe," and spawn a reverse SOCKS5 proxy. In addition, some artifacts include a 10-minute startup delay in a likely effort to avoid immediately connecting to the Yggdrasil network and evade detection.
"To our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor, and it may signal a broader trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure," ESET researchers Anton Cherepanov and Peter Strýček said.
MythicRatatoskr is said to have been used to deploy a SOCKS5 server to route connections through the compromised network. The attack culminated with Sandworm carrying out a data-wiping attack by dropping the SDelete utility via Active Directory Group Policy. It's worth noting that the Sandworm-linked NikoWiper malware is also derived from SDelete.
Yggdrasil map with the C&C server
While the attack investigated by ESET compromised a Windows environment, source code references to "crond" within MythicRatatoskr suggest there possibly exists an equivalent Linux version of the malware.
The assessment that UAC-0099 is likely collaborating with Sandworm is not new. In its APT Activity Report Q2 2025–Q3 2025, ESET said it observed UAC-0099 conducting initial access operations and subsequently transferring "validated targets" to Sandworm for further post-exploitation.
These attacks targeted government, energy, logistics, and grain sectors in Ukraine, the Slovak cybersecurity company noted at the time. ESET confirmed to The Hacker News that the MythicRatatoskr case was among those attacks.
This sort of cooperation between Russia-aligned actors is also not new. Last year, ESET said it identified evidence that Gamaredon and Turla were working together to target and co-compromise Ukrainian entities, with one intrusion leveraging Gamaredon's PteroGraphin to deploy Turla's Kazuar backdoor.
Furthermore, a Gamaredon-linked downloader called Pterodo has been used to retrieve and execute InvisiMole, a modular spyware program put to use against targets in Ukraine and Russia.
"This kind of cooperation underscores the potential for coordinated cyber espionage campaigns among Russia-aligned groups, likely intended to amplify their operational impact," ESET said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.