Sandworm Gets a Handoff, Wipes a Ukrainian Grain Firm

One Russia-aligned crew picked the lock, and another one came in to wreck the place. ESET researchers say the espionage group UAC-0099 phished its way into a Ukrainian grain logistics company in July 2025, and that Sandworm, the GRU-linked group behind Ukraine’s 2015 and 2016 blackouts, used that access to wipe data in September 2025. In between, a previously undocumented Go backdoor ESET calls MythicRatatoskr ran inside the network, hiding its command traffic in the Yggdrasil mesh network. The Record reports ESET calls this the first documented case of a state-aligned group abusing Yggdrasil to conceal C&C. ESET couldn’t tell which of the two groups ran the backdoor.

201:b479:2771:8df4:b5eb:d007:63b0[:]2838 (MythicRatatoskr C&C, Yggdrasil)
uztickets[.]com (MATCHWOK C&C)
egyptanimals[.]com (MATCHWOK download)

Service: ieupdate
C:\Windows\Temp\.updatecache (config)
%localappdata%\SMBCache\nbtresolver.exe (SOCKS5 server)

D5F9288DAEBF87AE4579945F8DC6CF235B093CFD (Act64.exe)
4E3E6577866E4CE2ED73CA089700AE04230E768F (ieupdate.exe)
09C816697C0C2AFF9B4FF58681558CA30D04C9CD (nbtresolver.exe)

Source article: MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
Publisher: ESET Research, WeLiveSecurity (authors: Anton Cherepanov, Peter Strýček)
Published: October 22, 2026
URL: https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/

Executive Summary

ESET Research describes a 2025 intrusion at a Ukrainian grain logistics company that it attributes to two cooperating Russia-aligned actors: UAC-0099, an espionage group named by CERT-UA, active since at least 2022 against Ukrainian government, finance, media, transportation, manufacturing and energy organizations and assessed by ESET as aligned with Russian interests with medium confidence; and Sandworm, which Western governments link to Russia’s GRU military intelligence and which ESET separately reported running destructive attacks on Ukrainian grain, energy, logistics and government organizations between June and September 2025. ESET attributes the July 2025 access stage to UAC-0099 and the September 2025 wiping to Sandworm, both with high confidence, and assesses with high confidence that UAC-0099 handed access to Sandworm; it has not determined which of the two operated the new backdoor. The chain began with a spearphishing attachment: on July 16, 2025 at 06:59 a scheduled task named pdfopentask ran a PowerShell payload from %temp%\temporarydoc.txt, and about a minute later UAC-0099’s MATCHBOIL downloader retrieved the MATCHWOK backdoor (C&C uztickets[.]com) from egyptanimals[.]com. On July 17 at 09:28 MythicRatatoskr, a previously undocumented Go backdoor, was delivered to the same machine. It runs as the Windows service ieupdate, can delay start by 10 minutes, joins the Yggdrasil mesh network through three random public peers from an embedded list of 32, and reaches a C&C at Yggdrasil address 201:b479:2771:8df4:b5eb:d007:63b0[:]2838 over HTTPS on port 443; it executes commands through cmd.exe, uploads and downloads files, takes screenshots, exposes ports and runs a reverse SOCKS5 proxy. More copies were deployed to other machines through an OpenSSH SFTP server, a separate Go SOCKS5 server (internally bindProxy) was planted listening on 127.0.0[.]1:33690, and on September 17, 2025 SDelete was deployed through Active Directory Group Policy to destroy data. ESET calls this the first documented abuse of Yggdrasil by a state-aligned actor to hide C&C. The objective moved from access and espionage to destruction of a food-logistics target during the war. Hunt leads, false-positive expectations and indicators are detailed below; ESET published no YARA or Sigma rules for this activity.

ATT&CK chain: Initial Access → Execution → Persistence → Defense Evasion → Lateral Movement → Collection → Command and Control → Exfiltration → Impact

Hunt Lead Grid

Yggdrasil Peering and C&C Traffic

MythicRatatoskr makes the infected host a Yggdrasil node: it generates an Ed25519 key pair, which gives it an IPv6 address in the 200::/7 range, sets an empty NodeInfo with the privacy flag, picks three peers at random from 32 public Yggdrasil peers embedded in the binary, and then talks to its C&C at 201:b479:2771:8df4:b5eb:d007:63b0[:]2838 over HTTPS on port 443 inside the mesh; its proxy command connects to the same address on port 8080 (ESET’s IOC table writes the C&C without the leading 201:). Some samples wait 10 minutes after starting before connecting, which ESET reads as a way to avoid an immediate network burst on execution. Because the C&C lives inside an encrypted overlay, perimeter tools never see a C&C domain or IP; what they can see is the peering. The detection logic is a sweep of firewall, proxy, DNS and EDR network logs for outbound TLS, QUIC or TCP connections to the public peers ESET lists (a sample is below, de-fanged, without the key parameters), for DNS lookups of their hostnames, and on hosts with EDR for any process that creates a TUN adapter or binds an address in 200::/7.

Use firewall and NetFlow for the IP peers, DNS logs for the hostname peers, and EDR for the process making the connection, and sweep back to July 2025 if the environment is in or supplies the Ukrainian logistics, agriculture or energy sectors, otherwise 90 days. Scope it to every Windows server and workstation; only research or hobbyist hosts that knowingly run Yggdrasil should be allowlisted, by host and by signed client path, never by peer. Blocking the peers is the mitigation ESET suggests, but understand what it is: these are volunteer-run public nodes, not attacker infrastructure, so a peer hit is evidence of a Yggdrasil client, not of this actor, and the list will go stale as the actor can embed new peers. Confirm the exact peer strings, including the key parameters, against ESET’s article before blocking. A peer connection from a host with no sanctioned Yggdrasil use should be escalated to incident response and pivoted to the host-artifact lead below. The approach generalizes to any malware that hides C&C in an overlay network (Tor, I2P, Yggdrasil): hunt the bootstrap, not the C&C.

Yggdrasil public peers embedded in MythicRatatoskr, a subset as transcribed from the source article (de-fanged; key parameters omitted; verify against the source before use):

tls://37.205.14[.]171:993
tls://109.176.250[.]101:65534
tls://65.21.57[.]122:61995
tls://95.217.35[.]92:1337
tls://51.255.223[.]60:54232
tls://51.15.204[.]214:54321
tls://s2.i2pd[.]xyz:39575
tls://62.210.85[.]80:39575
tls://vpn.ltha[.]de:443
tls://mlupo.duckdns[.]org:9001
quic://ip6.fvm.mywire[.]org:443
tls://helium.avevad[.]com:1337
tls://yggdrasil.neilalexander[.]dev:64648
tls://bode.theender[.]net:42169
tls://g.ygg[.]yt:443
tls://b.ygg[.]yt:443
tls://n.ygg[.]yt:443
tls://ygg1.grin[.]hu:42444
tls://srl.newsdeef[.]eu:59999
tls://23.137.249[.]65:444
tls://ygg-nl.incognet[.]io:8884
quic://0.ygg.l1qu1d[.]net:11102
tls://london.sabretruth[.]org:18472
tls://yggdrasil.sunsung[.]fun:4443
tls://78.27.153[.]163:33166
tls://193.93.119[.]42:443
tcp://sysop[.]link:555
tls://sto01.yggdrasil.hosted-by.skhron[.]eu:8884
tls://ygg.ace.ctrl-c.liu[.]se:9999
quic://spain.magicum[.]net:36900
tcp://y.zbin[.]eu:7743

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1090.003 (Proxy: Multi-hop Proxy), mapping per source article; detection strategy DET0359 Multi-hop Proxy Behavior via Relay Node Chaining, Onion Routing, and Network Tunneling. ESET also maps the HTTPS C&C to T1573 (Encrypted Channel) and T1071.001 (Application Layer Protocol: Web Protocols), and the start-up delay to T1678 (Delay Execution).

Sources: “MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration”, ESET Research (WeLiveSecurity), Oct. 22, 2026, https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/ (source article); “MythicRatatoskr … Indicators of Compromise”, ESET malware-ioc repository, https://github.com/eset/malware-ioc/tree/master/mythicratatoskr (additional source, same campaign, published by the same vendor)

ieupdate Service and MythicRatatoskr Install Paths

MythicRatatoskr runs as a Windows service named ieupdate, and ESET says event logs show updater.exe and WindowsDefenderSvc.exe were also started as services, likely for persistence. ESET lists the backdoor at C:\windows\system32\updater.exe, C:\Windows\system32\krbtman.exe, C:\windows\system32\windowsdefendersvc.exe, %localappdata%\Microsoft\OneDrive\OneDriveLiveUpdater.exe, c:\program files (x86)\microsoft.net\adomd.net\110\applicationasphost.exe, C:\OFFICE2010\Utilities\Act64.exe, %userprofile%\Downloads\WindowsDefenderSvc.exe, %userprofile%\Downloads\ieupdate.exe, %userprofile%\Downloads\ie.exe, %userprofile%\AppData\Local\Internet Explorer\ieupdate.exe and %userprofile%\AppData\Local\ieupdate.exe. Its configuration is stored AES-256-CFB encrypted (first 16 bytes are the IV, key hardcoded in the binary) at C:\Windows\Temp\.updatecache, C:\Windows\system32\.updatecache or %LocalAppData%/Temp/.crond. The detection logic is a sweep for the service name ieupdate in service creation events (System event ID 7045, Security event ID 4697) and the registry under HKLM\SYSTEM\CurrentControlSet\Services; any service whose image path is one of the files above; any file at those paths, or a file named .updatecache or .crond in those directories; and the SHA-1 values in the appendix.

Use EDR file and process inventory, Windows System and Security event logs forwarded to a SIEM, and a one-off live query across all Windows endpoints and servers for services and files, sweeping logs back as far as retention allows. Names like updater.exe and OneDriveLiveUpdater.exe are generic, so match on full path plus the absence of a valid vendor signature rather than on name. The SHA-1 values are useful for a retrospective sweep, but hash blocking alone is the wrong primary control because a Go backdoor rebuilt with a new configuration gets a new hash; the service name, paths and the hidden configuration files are steadier anchors. ESET recovered a hardcoded AES key from the samples it analysed, so a reverse engineer with a recovered .updatecache file can try decrypting it with the key ESET published to read the peers and C&C. Any match is an escalation to incident response: treat the host as compromised, collect memory and disk, and pivot to the SFTP and SOCKS5 leads to find other hosts.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Persistence → T1543.003 (Create or Modify System Process: Windows Service), mapping per source article; detection strategy DET0552 Detection of Windows Service Creation or Modification. ESET also maps the encrypted configuration to T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File).

Sources: “MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration”, ESET Research (WeLiveSecurity), Oct. 22, 2026, https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/ (source article); ESET malware-ioc repository, https://github.com/eset/malware-ioc/tree/master/mythicratatoskr (additional source, same campaign, published by the same vendor)

UAC-0099 pdfopentask Loader Chain

The intrusion’s first visible step was on July 16, 2025 at 06:59, when a scheduled task named pdfopentask executed a PowerShell payload stored in %temp%\temporarydoc.txt, following a phishing email with a malicious attachment. About one minute later UAC-0099’s MATCHBOIL downloader fetched the MATCHWOK backdoor from egyptanimals[.]com (path /animals/photoalbum), and MATCHWOK used uztickets[.]com as its C&C. The next day, at 09:28 on July 17, MythicRatatoskr arrived on the same machine, which gives a useful sequence: a scheduled task, then a PowerShell process reading a .txt file in the user temp folder, then an outbound download within a minute, then a new executable and service within roughly a day. The detection logic is a sweep of scheduled task creation events (Security event ID 4698, TaskScheduler Operational log) and the task store for pdfopentask, a sweep of PowerShell process creation and script block logs (event ID 4104) for references to temporarydoc.txt, and a sweep of DNS and proxy logs for the two domains.

Use EDR process telemetry, Windows Security and PowerShell Operational logs, and DNS and web proxy logs, sweeping back to mid-2025 for organizations in Ukraine or in its supply chains, since UAC-0099 has been active since at least 2022 and ESET points to the same toolset in CERT-UA’s prior reporting. The broader behavioral version of this lead, a scheduled task that launches PowerShell against a file in %temp% shortly after an email attachment is opened, generalizes well beyond this group, but tune it by allowlisting signed updater tasks by their registered author and image path. Blocking the two domains is reasonable, but on its own is the wrong control because UAC-0099 rotates infrastructure; the task-plus-temp-file pattern lasts longer. Any hit is an escalation to incident response, because in this case that first foothold is the access that was later handed to a destructive actor.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Execution / Persistence → T1053.005 (Scheduled Task/Job: Scheduled Task), detection strategy DET0441 Detection of Suspicious Scheduled Task Creation and Execution on Windows; Command and Control → T1105 (Ingress Tool Transfer). ESET’s table maps this stage to T1566.001 (Phishing: Spearphishing Attachment) and lists T1105; T1053.005 is added here because the source describes the pdfopentask scheduled task running the payload, which ESET’s table does not map because it leaves MATCHBOIL and MATCHWOK to earlier reports.

Sources: “MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration”, ESET Research (WeLiveSecurity), Oct. 22, 2026, https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/ (source article)

Loopback SOCKS5 Listener on Port 33690

Alongside the backdoor, the actor deployed a separate Go SOCKS5 server, probably through MythicRatatoskr, that ESET says is internally named bindProxy and built on the open-source go-socks5 library. It listens only on 127.0.0[.]1:33690, so it is not reachable from the network on its own; ESET notes the backdoor’s expose command, which forwards TCP connections from the Yggdrasil network to a local port, could have made it reachable through the mesh. ESET found it at C:\Windows\system32\krbtman.exe, %userprofile%\Downloads\krbtman.exe and %localappdata%\SMBCache\nbtresolver.exe, with names chosen to resemble Kerberos and NetBIOS components. MythicRatatoskr also has a built-in reverse SOCKS5 proxy. The detection logic is a rule on EDR socket or listening-port telemetry (or Sysmon network events) for any process listening on TCP 33690, joined to the image path, and more broadly for unsigned binaries in system32, user Downloads or %localappdata% that open a loopback listener and also have an established connection from the same process or its parent to a Yggdrasil peer.

The port-specific rule is cheap and precise; the broader “unsigned binary opens a loopback listener” rule needs tuning, because developer tools, local web proxies and some security agents do the same, so allowlist by signer and full path rather than by process name and scope the rule first to servers and non-developer workstations. Sweep back to July 2025 where telemetry exists, and run a live check for the listener today. Blocking the port at the host firewall is the wrong fix because the listener is on loopback and the traffic never crosses the firewall; detect and remove the process instead. Pair a hit with the Yggdrasil peering lead: a loopback SOCKS5 listener on a host that also peers into Yggdrasil means the actor can pivot traffic into the internal network through the mesh, and that combination is an incident, not a tuning case.

Hunt Lead Level: 2 (Pro)

ATT&CK: Command and Control → T1090.001 (Proxy: Internal Proxy), mapping per source article; detection strategy DET0075 Internal Proxy Behavior via Lateral Host-to-Host C2 Relay

Sources: “MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration”, ESET Research (WeLiveSecurity), Oct. 22, 2026, https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/ (source article)

Executables Dropped Through OpenSSH SFTP

After the first host, ESET says additional MythicRatatoskr samples were deployed to other machines in the organization using an OpenSSH SFTP server; the article does not give the accounts, source hosts or exact commands used. The install paths in the previous lead show where those files landed, including system32, user Downloads folders and %localappdata%, and the event logs show several of them then started as services. The detection logic is a rule on EDR file-creation telemetry (or Sysmon event ID 11) for new .exe files written by sshd.exe or sftp-server.exe, or by a child of either, into C:\Windows\system32, a user’s Downloads folder or %localappdata%, followed on the same host within hours by a new service whose image path is that file (System event ID 7045). Supporting evidence comes from the OpenSSH Operational event log, which records the account and source address of each SSH logon.

This needs per-environment scoping: first inventory which Windows hosts run the OpenSSH server at all, because on many networks the answer is none, and on those hosts any SFTP write of an executable is suspicious on its own. Where SFTP is used for administration or deployment, allowlist by named account and source host and keep the rule for writes into system directories followed by service creation. Sweep back to July 2025 where telemetry exists. Disabling the OpenSSH server where it is not needed is a sound hardening step, but it does not replace the hunt, because the attacker may have installed or enabled the server themselves. A hit should be escalated, and the source address of the SSH session becomes the next host to investigate, since it may be the original foothold. The rule generalizes to any actor that uses built-in remote file transfer to spread tooling.

Hunt Lead Level: 2 (Pro)

ATT&CK: Lateral Movement → T1570 (Lateral Tool Transfer); detection strategy DET0183 Detection Strategy for Lateral Tool Transfer across OS platforms. ESET’s table does not map this step; T1570 is assigned here because the source describes the backdoor being copied to other machines over SFTP.

Sources: “MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration”, ESET Research (WeLiveSecurity), Oct. 22, 2026, https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/ (source article)

SDelete Pushed Through Group Policy

On September 17, 2025, two months after the first access, data was destroyed by deploying SDelete, a legitimate Microsoft Sysinternals secure-deletion tool, through Active Directory Group Policy, which ESET says is consistent with Sandworm tradecraft. ESET does not publish the GPO name, file paths or command lines. Distributing a wiper through Group Policy means one change on a domain controller reaches every computer the policy applies to at its next refresh, so the window between the change and widespread destruction can be short. The detection logic correlates two sources: on domain controllers, changes to Group Policy objects (Security event IDs 5136, 5137 and 5141 for directory-service changes, plus new or changed files under the SYSVOL Policies folder such as scheduled task XML, startup scripts or software installation entries) made outside change control or by an unexpected account; and on endpoints, process creation of sdelete.exe, sdelete64.exe or a renamed binary carrying Sysinternals SDelete metadata, especially with the Sysinternals EULA-accept registry key appearing for SDelete on many hosts at once, and especially when the parent is the Group Policy client, the task scheduler or a startup script.

This needs detection engineering: stream directory-service change auditing and SYSVOL file monitoring from domain controllers, join it to endpoint process data, and alert when SDelete starts on more than a small baseline number of hosts within a short window after a GPO change, with the threshold set from the organization’s normal SDelete use (often zero). Sweep historically for any GPO that has ever deployed SDelete. Do not block SDelete by hash: it is a legitimate Microsoft-signed tool, so the hash block breaks sanctioned disposal and is trivially bypassed by a renamed copy; detect the deployment path and the fan-out instead, or restrict it with application control by path and parent. A correlated hit is a live destructive attack: escalate immediately, unlink the offending GPO, and isolate affected hosts rather than waiting to tune. Because Sandworm and other destructive actors have repeatedly used Group Policy to spread wipers, the rule generalizes beyond this incident.

Hunt Lead Level: 3 (Elite)

ATT&CK: Defense Evasion / Privilege Escalation → T1484.001 (Domain or Tenant Policy Modification: Group Policy Modification), detection strategy DET0305 Detection of Group Policy Modifications via AD Object Changes and File Activity; Impact → T1485 (Data Destruction), mapping per source article, detection strategy DET0146 Detection of Data Destruction Across Platforms via Mass Overwrite and Deletion Patterns. ESET maps only T1485; T1484.001 is added because the source describes the wiper being deployed through Group Policy.

Sources: “MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration”, ESET Research (WeLiveSecurity), Oct. 22, 2026, https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/ (source article); “Russian hackers teamed up to wipe data at Ukrainian grain firm”, The Record (Daryna Antoniuk), Oct. 21, 2026, https://therecord.media/ukraine-hackers-russia-grain-sandworm (additional source, same campaign; Sandworm background)

Hash Appendix

MythicRatatoskr backdoor

The SHA-1 values come from the source article and ESET’s malware-ioc repository, which publish SHA-1 only. OTX AlienVault had no file analysis or pulses for the hashes checked, and VirusTotal could not be queried without an authenticated account, so MD5 and SHA-256 are not available. The last ieupdate.exe hash differs by one character between the two ESET sources (...F1629D... in the article, ...F1429D... in the repository as retrieved), so both are listed; sweep for both until ESET corrects one.

MD5s

(not available)  # Act64.exe, ie.exe, ieupdate.exe, krbtman.exe, OneDriveLiveUpdater.exe, windowsdefendersvc.exe, updater.exe (MythicRatatoskr)

SHA1s

D5F9288DAEBF87AE4579945F8DC6CF235B093CFD  # Act64.exe -> C:\OFFICE2010\Utilities\Act64.exe (MythicRatatoskr, WinGo/Agent.ZO)
B69EF0E45B401440C0FDE22046775D0C57E87415  # ie.exe -> %userprofile%\Downloads\ie.exe (MythicRatatoskr, WinGo/Agent.ZO)
4E3E6577866E4CE2ED73CA089700AE04230E768F  # ieupdate.exe -> MythicRatatoskr, service "ieupdate" (WinGo/Agent.ZO)
69969EEB7E0A3D84C4E70193636FCF934C6AA388  # ieupdate.exe -> MythicRatatoskr, service "ieupdate" (WinGo/Agent.ZO)
01855153CA7A33AD5FF36451DE5612DFBA0DD2CA  # krbtman.exe -> C:\Windows\system32\krbtman.exe (MythicRatatoskr, WinGo/Agent.ZO)
E29AF83A07FB32EB47C28733A9382E766D53F704  # OneDriveLiveUpdater.exe -> %localappdata%\Microsoft\OneDrive\ (MythicRatatoskr, WinGo/Agent.ZO)
028CA11F3F0D8396043AF7BF756231FC2F50F829  # windowsdefendersvc.exe -> C:\windows\system32\ or %userprofile%\Downloads\ (MythicRatatoskr, WinGo/Agent.ZO)
9085896989947C0919A660352F75F6B233FC645B  # windowsdefendersvc.exe -> C:\windows\system32\ or %userprofile%\Downloads\ (MythicRatatoskr, WinGo/Agent.ZO)
D7E6A5A46C6ED3510997E91B11E51BE0250FD2A2  # updater.exe -> C:\windows\system32\updater.exe (MythicRatatoskr, WinGo/Agent.ZO)
8CEB5F8BCDF4995B7164996F1629D682613BB17B  # ieupdate.exe -> MythicRatatoskr (WinGo/Agent.ZO); value as given in the ESET article
8CEB5F8BCDF4995B7164996F1429D682613BB17B  # ieupdate.exe -> same file; value as given in the ESET malware-ioc repository

SHA256s

(not available)  # Act64.exe, ie.exe, ieupdate.exe, krbtman.exe, OneDriveLiveUpdater.exe, windowsdefendersvc.exe, updater.exe (MythicRatatoskr)

bindProxy SOCKS5 server

The SHA-1 values come from the source article and ESET’s malware-ioc repository; MD5 and SHA-256 are not available for the same reasons as above.

MD5s

(not available)  # krbtman.exe, nbtresolver.exe (SOCKS5 server)

SHA1s

131A371A1E4EE78EC3B2863607C99290EC3B58A6  # krbtman.exe -> C:\Windows\system32\ or %userprofile%\Downloads\ (SOCKS5 server, WinGo/Agent.AOK)
09C816697C0C2AFF9B4FF58681558CA30D04C9CD  # nbtresolver.exe -> %localappdata%\SMBCache\nbtresolver.exe (SOCKS5 server, WinGo/TrojanProxy.Agent.I)

SHA256s

(not available)  # krbtman.exe, nbtresolver.exe (SOCKS5 server)

SDelete wiper

ESET publishes no hash for the SDelete binary used. SDelete is a legitimate Microsoft Sysinternals tool, so blocking its hash would break legitimate secure-disposal use; detect the Group Policy deployment, the parentage and the multi-host fan-out instead.

MD5s

(not available)  # SDelete (legitimate Sysinternals tool deployed via Group Policy; do not block by hash)

SHA1s

(not available)  # SDelete (legitimate Sysinternals tool deployed via Group Policy; do not block by hash)

SHA256s

(not available)  # SDelete (legitimate Sysinternals tool deployed via Group Policy; do not block by hash)

References Appendix

• “MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration”, ESET Research (WeLiveSecurity), Anton Cherepanov and Peter Strýček, Oct. 22, 2026, https://www.welivesecurity.com/en/eset-research/mythicratatoskr-yggdrasil-enabled-backdoor-deployed-uac0099-sandworm-collaboration/ (source article; timeline, malware analysis, attribution, ATT&CK mapping, IOCs, Yggdrasil peer list)
• “MythicRatatoskr … Indicators of Compromise”, ESET, malware-ioc repository on GitHub, https://github.com/eset/malware-ioc/tree/master/mythicratatoskr (SHA-1 hashes, detection names, C&C address)
• “Russian hackers teamed up to wipe data at Ukrainian grain firm”, The Record from Recorded Future News, Daryna Antoniuk, Oct. 21, 2026, https://therecord.media/ukraine-hackers-russia-grain-sandworm (UAC-0099 and Sandworm background)
• OTX AlienVault file indicator lookups for the MythicRatatoskr SHA-1 values, AT&T Alien Labs, accessed Oct. 22, 2026, https://otx.alienvault.com/ (hash provenance check; no pulses or MD5/SHA-256 available)
• MITRE ATT&CK Enterprise technique and detection-strategy pages linked above, MITRE, https://attack.mitre.org/