Two Russian-linked hacking groups worked in sequence against a Ukrainian grain logistics company, and the second one wiped the victim’s data. That is the core of reporting from SC Media, Reuters, shattered.io, the Miami Herald and Babel, all of which describe a handoff between the group tracked as UAC-0099 and Sandworm. The company has not been publicly identified.
The timeline in the reports is tight and uncomfortable for defenders. Initial access came on July 16, 2025, through a phishing email with a malicious attachment. The destructive phase landed on September 17, 2025, when attackers ran a legitimate Microsoft deletion utility called SDelete across affected computers. That leaves roughly 63 days between the first foothold and the wipe, a window in which most security teams would expect to catch a persistent intruder.
This analysis walks through what the reports establish, what they leave open, and why the case matters for logistics, agriculture and any business that moves goods in or near a conflict zone. Ukraine’s wartime technology stack has been under pressure on several fronts, as our coverage of the Starshield dip that cut Ukraine’s drone defense showed. A destructive hit on a grain logistics firm fits the same pattern of attacks on systems that keep the country’s economy and defense moving.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What the Reports Say Happened to the Ukrainian Grain Logistics Firm
The victim is described as a Ukrainian grain logistics company. Its name, location, financial loss, number of affected systems and any ransom demand are not stated in the cited reports, so none of those details can be treated as fact. Outlets including SC Media and Reuters agree on the broad outline, and the technical detail traces to ESET research.
According to the reporting, an attacker first got in through a phishing or spear-phishing email carrying a malicious attachment. From there, a backdoor called MythicRatatoskr gave the intruders a way to run commands on the victim’s machines. Later, after gaining administrator privileges, the attackers used SDelete to wipe data from affected computers.
Researchers assessed that UAC-0099 gained the initial access and later handed that access to Sandworm. The word “assessed” matters here. It signals a judgment built from technical evidence rather than a confession or a forensic proof of control at every moment of the intrusion.
Timeline: From the July 16 Phishing Email to the September 17 Wipe
The table below lays out the sequence as the reports describe it. Dates come from the cited coverage. The attribution column reflects the researchers’ assessment, not a court finding or an official government statement.
| Phase | Date | What happened | Actor (as assessed) |
|---|---|---|---|
| Initial access | July 16, 2025 | Phishing email with a malicious attachment reaches the victim | UAC-0099 |
| Persistence | After July 16, 2025 | MythicRatatoskr backdoor gives remote command execution | UAC-0099 |
| Command and control | Throughout the intrusion | Traffic runs over the Yggdrasil network | Not confirmed who operated it |
| Handoff | Between July and September 2025 | Access passes to a second group | UAC-0099 to Sandworm |
| Privilege escalation | Before September 17, 2025 | Attackers obtain administrator privileges | Sandworm (assessed) |
| Destruction | September 17, 2025 | SDelete wipes data from affected computers | Sandworm (assessed) |
Two details stand out. The gap between first access and the wipe runs about nine weeks, and the middle of the timeline is the least certain part. ESET reportedly could not determine which group operated MythicRatatoskr between the initial breach and the data-wiping phase, which is exactly the stretch where the handoff supposedly happened.
UAC-0099: The Initial-Access Group
UAC-0099 is the tracking label for the group credited with the first breach. The “UAC” naming style is used by Ukrainian authorities to label uncategorized threat clusters, and the label says little by itself about who staffs the group or who funds it. What the reports do say is that it opened the door in July 2025 with a mundane tool: a malicious email attachment.
Phishing remains the cheapest way into a target. It needs no zero-day exploit and no expensive infrastructure, only a believable message and one employee who opens the file. For a logistics firm, a message that looks like a shipping document, an invoice or a customs form is a natural lure, though the reports do not say what lure was used in this case.
The access-broker role is worth understanding. One crew handles the noisy, repetitive work of getting in, and another takes over when a target looks valuable. That division of labor is familiar in criminal ransomware, and the reports suggest it has now shown up in a campaign tied to Russia’s military intelligence ecosystem. A patch-lag story from our own archive, the Qilin ransomware attacks on Palo Alto VPNs patched five months earlier, shows how slowly defenders close known doors. Here, the door was an inbox.
MythicRatatoskr: A Previously Undocumented Backdoor
The backdoor at the center of the case is MythicRatatoskr, described in the reports as previously undocumented. That means researchers had no public write-up of it before this intrusion, so signature-based tools had little to match against.
The reported capabilities are broad and practical:
- Remote command execution on the infected machine
- File browsing and exfiltration
- Screenshot capture
- Reverse SOCKS5 proxy deployment, which lets the attacker route traffic through the victim’s network
The reverse SOCKS5 proxy deserves attention. It turns an infected workstation into a relay, so an intruder can reach internal servers that never face the internet. Screenshot capture gives operators a view of what staff are doing, which helps them find the systems and people that matter before they strike.
Reports also mention MatchWok, described as an earlier backdoor, and Matchboil, which was reported in connection with the intrusion. The cited coverage does not lay out exactly how these tools relate to MythicRatatoskr, so readers should not assume a clean lineage between them. The safe reading is that the operators had more than one implant in their kit.
Why Yggdrasil Matters for Command-and-Control
The attackers used Yggdrasil for command-and-control communications. Yggdrasil is a decentralized, volunteer-run network, which makes it unusual as a hiding place. There is no single hosting provider to call, no domain registrar to pressure and no central server to seize.
For defenders, that changes the monitoring job. Blocking a handful of known command servers does not work when the infrastructure is a mesh run by volunteers. Network teams are better off asking a different question: why is a grain logistics workstation speaking to an overlay network at all? Traffic to a mesh network that no business process needs is a strong signal on its own, even when the payload is unreadable.
What decentralized command channels change
Traditional takedowns rely on chokepoints. Decentralized networks remove them, which pushes the burden onto the victim’s own egress controls. Allow-listing outbound destinations, rather than trying to block bad ones, is the control that scales best against this style of channel.
The Handoff to Sandworm
Sandworm is widely linked by Western intelligence agencies and researchers to Russia’s military intelligence service, the GRU. The reports say researchers assessed that UAC-0099 handed the access it had built to Sandworm, and that Sandworm then carried out the destructive stage.
This is the analytically interesting piece. A destructive operation against a commercial logistics firm needs two things: a foothold and a decision to burn it. The reports suggest one group supplied the foothold and another supplied the decision. If that reading holds, defenders face a worse problem than a single actor. A “low-severity” phishing incident logged in July could be the first step in a September wiper campaign run by someone else.
The caveat is firm. ESET reportedly could not tell which group operated MythicRatatoskr between the first breach and the wipe. The handoff is an assessment, and the evidence for who held the keys on any given day is incomplete. Anyone quoting this story as proof of formal cooperation between the groups is going further than the researchers did.
SDelete: A Legitimate Tool Used as a Wiper
The destructive tool was SDelete, a legitimate file-deletion utility from Microsoft. Using it fits a broader pattern of living off the land, where attackers prefer trusted software over custom malware. A custom wiper triggers antivirus alerts and leaves a distinct sample for researchers. A signed Microsoft utility, run by an account with administrator rights, looks a lot more like routine maintenance.
The practical lesson: you cannot defend against this by hunting only for malware. The relevant questions are about behavior. Who ran a secure-delete tool on a production file server? From which account? At what hour? Should that tool exist on that machine at all?
Teams that log process creation can answer those questions in minutes. Teams that do not will find out after the data is gone. Our walkthrough on setting up Sysmon to detect ransomware on Windows covers the same telemetry that would flag an unexpected SDelete run, since the logging need is identical for wipers and for encryptors.
What ESET’s Anton Cherepanov Said
Anton Cherepanov of ESET said the attackers activated a data-wiping tool after they gained administrator privileges. That sequencing is the key operational point. Privilege escalation came first, destruction second, and the wipe was a deliberate act rather than a side effect of a misfired payload.
It also tells defenders where the last good chance to intervene sits. Between “the attacker holds a user account” and “the attacker holds administrator rights,” there is usually a window of alerts: new accounts, changed group memberships, credential dumping, remote service creation. Teams with tight controls on administrator access can turn a catastrophic wipe into a contained incident.
What Remains Unconfirmed
Several details that readers will want are simply not in the cited reports. Treat each of the following as unknown until a named source states otherwise:
- The name and location of the victim company
- Financial loss or business downtime
- The number of systems wiped
- Whether any ransom was demanded
- Which group operated MythicRatatoskr between the breach and the wipe
- Whether backups allowed recovery
The absence of a ransom demand in the reporting is itself informative, but only as an absence. The reports do not say a demand was made, and they do not say it was not. A wiper that destroys data without a payment channel points toward disruption rather than profit, yet the sources stop short of stating motive.
Why Grain Logistics Is a Target
The reports do not explain why this company was picked, and nobody outside the attackers can say for sure. The sector context is still worth stating plainly. Grain is a major part of Ukraine’s economy and its export story, and logistics firms sit at the point where harvests meet ports, rail and trucks. Disrupting scheduling, tracking and billing systems can slow physical movement of goods without touching a single field or silo.
Logistics companies also hold data that intelligence services value: shipment routes, customer lists, timing and capacity. A backdoor with file exfiltration and screenshot capture, as MythicRatatoskr reportedly offers, is as useful for gathering that kind of information as it is for setting up a wipe. Whether any data left the network before September 17 is not stated in the sources.
Market and Business Impact
No financial figures are published, so any dollar estimate would be invention. The qualitative impact is clearer. A wiped logistics firm loses dispatch records, contracts, invoices and tracking history. Recovery depends on backups that were isolated from the network the attackers controlled for about nine weeks. Backups reachable from a compromised administrator account tend to die with the primary data.
For insurers, shippers and trading partners, the case reinforces a point that has been building across the cybersecurity beat: supply-chain firms are priced as if they face criminal risk, but some now face state-linked destructive risk. Cyber insurance policies often carve out acts of war, and a wiper attributed to a military intelligence unit tests those clauses. Customers of Ukrainian logistics providers, and of providers elsewhere with exposure to the conflict, will ask harder questions about segmentation and offline backups.
Security vendors gain as well. A previously undocumented backdoor, a decentralized command channel and a trusted-tool wiper make a clean sales story for endpoint detection, network monitoring and incident response retainers. That does not make the threat less real, but readers should weigh vendor commentary with that incentive in mind.
Wipers vs. Ransomware: A Competitive Comparison of Attack Models
The case is easiest to understand next to ransomware, which dominates headlines. The table compares the two models in general terms. It describes patterns, not measurements, and it does not claim numbers for this incident.
| Factor | Wiper operation (this case) | Typical ransomware operation |
|---|---|---|
| Primary goal | Destroy data and disrupt operations | Extract payment |
| Recovery path | Backups or rebuild only | Backups, rebuild, or paying for a decryption key |
| Tooling in this case | Legitimate SDelete utility, administrator rights | Custom encryptor, often with leak site |
| Negotiation | No ransom demand reported | Central to the model |
| Actor profile | State-linked group, per researchers’ assessment | Criminal affiliates and crews |
| Dwell time reported | About 63 days from first access to wipe | Varies by crew |
| Hidden cost | Permanent loss if no clean backup exists | Data theft and extortion even after restore |
The practical difference shows up at the end. A ransomware victim at least has a decision to make. A wiper victim has a restore job. For a broader look at the criminal side of this market, see our report on how the FBI and CISA tied SafePay ransomware to 600 victims. The contrast with this Ukrainian case is the purpose, not the technique.
Historical Context: Sandworm’s Record Against Ukraine
Sandworm is not a newcomer. Researchers and Western governments have tied the group to destructive operations against Ukraine for years, including attacks on the country’s power grid in 2015 and 2016 and the NotPetya outbreak in 2017. NotPetya looked like ransomware but worked as a wiper, a deception that fooled many victims into hoping for a decryption key that did not exist.
Seen against that record, the grain logistics case is consistent rather than surprising. The targets shift from grids to commercial supply chains, and the tools shift from custom malware to borrowed utilities, but the objective of imposing damage on Ukraine’s functioning economy stays the same. What is new in this reporting is the apparent use of an outside group, UAC-0099, to supply the access.
That structure may be a deliberate choice. Buying or borrowing access saves time and spreads the operational footprint across more than one cluster of infrastructure, which complicates attribution. It also means that tracking only the “famous” group can leave defenders blind to the earlier, quieter stages.
Defender Playbook: Closing the 63-Day Window
Nothing in the reports suggests exotic defenses were required to interrupt this intrusion. The failure points are the ordinary ones. These steps map directly to the stages described:
- Harden the inbox. Block or detonate risky attachment types, and treat every phishing report as a possible start of a long intrusion, not a closed ticket.
- Restrict outbound traffic. Allow-list egress so overlay networks like Yggdrasil cannot be reached from servers and workstations that have no reason to use them.
- Log process creation. Alert on secure-delete tools, new proxies and unusual administrator activity.
- Protect administrator rights. Use separate admin accounts, just-in-time elevation and tiered access so one stolen session cannot reach everything.
- Keep offline backups. Store at least one copy that no domain account can modify or delete, and test restores on a schedule.
Finding forgotten, internet-facing assets is another early win. Our tutorial on building attack surface management with subfinder, httpx and naabu shows how a small team can map exposure in about 75 minutes. A phishing-led intrusion bypasses the perimeter, but a clear asset inventory still speeds up scoping once an alert fires.
Predictions: What Comes Next
These are analytical expectations, not reported facts.
- More published detail on MythicRatatoskr. A previously undocumented backdoor rarely stays unique. Expect more researchers to publish indicators, and expect other victims to surface once defenders know what to search for.
- Greater scrutiny of access handoffs. Security vendors will start tracking how access moves between clusters, and incident reports will more often name two actors instead of one.
- Policy attention on logistics and agriculture. Regulators and insurers will likely treat grain and freight firms as critical-infrastructure-adjacent, which brings reporting and resilience requirements.
- Wider use of trusted-tool wipers. Attackers copy what works. Other groups may adopt legitimate utilities for destruction because they blend into administration traffic.
- Decentralized networks on blocklists. Enterprises will begin blocking overlay networks like Yggdrasil by default at the network edge, which will push operators toward other channels.
Frequently Asked Questions
Who attacked the Ukrainian grain logistics company?
Reports from outlets including SC Media and Reuters say UAC-0099 gained initial access and that researchers assessed it later handed access to Sandworm, which carried out the data-wiping stage. Sandworm is widely linked by Western intelligence agencies and researchers to Russia’s GRU.
Has the victim company been named?
No. The company’s name and location are not publicly identified in the cited reporting, and neither are the financial loss, the number of affected systems or any ransom demand.
When did the intrusion begin and when did the wipe happen?
Initial access came on July 16, 2025, through a phishing email with a malicious attachment. The destructive attack followed on September 17, 2025.
What is MythicRatatoskr?
It is a previously undocumented backdoor. The reports credit it with remote command execution, file browsing or exfiltration, screenshot capture and reverse SOCKS5 proxy deployment. Its command-and-control traffic ran over the Yggdrasil network.
What is SDelete and why did attackers use it?
SDelete is a legitimate Microsoft file-deletion utility. Attackers used it to wipe data after gaining administrator privileges, according to ESET’s Anton Cherepanov. A trusted tool is harder to spot than custom malware, because it looks like routine administration.
Which group operated the backdoor before the wipe?
That remains unconfirmed. ESET reportedly could not determine which group operated MythicRatatoskr between the initial breach and the data-wiping phase, so the handoff to Sandworm is an assessment rather than a proven fact.
How can companies reduce the risk of a similar attack?
Tighten email attachment handling, restrict outbound network destinations, log process creation, limit administrator privileges and keep offline backups that domain accounts cannot alter. The reported 63-day gap between first access and the wipe means each of these controls had time to catch the intruders.
