Post

at 06:59 on july 16, 2025, a scheduled task called pdfopentask woke up inside a ukrainian grain company and ran a line of powershell from a file named temporarydoc.txt.

sixty-three days later, the company's own management plane was weaponized against itself, pushing a free microsoft utility across the environment to erase its data.

www.welivesecurity.com/en/eset-rese...

one russia-aligned threat actor broke in and held the ground for weeks. a second, far more dangerous one arrived at the end to burn it all down.

the group that opened the door is tracked by ukraine's cert-ua as uac-0099, a russia-aligned espionage activity cluster active since at least 2022. eset assesses with high confidence that uac-0099 handled initial access and can operate as an initial access broker for a heavier hand.

that heavier hand is voodoo bear, also known as sandworm across the industry, the gru's destructive adversary linked to unit 74455 and to a decade of wiper campaigns and power-grid attacks against ukraine.

the way in was rather dull yet effective. a spear-phishing email carried a malicious attachment, consistent with cert-ua's own findings. no exploit, no edge-device cve, no clever zero-day.

that new backdoor is the reason this report matters beyond one wiped grain company. what sets mythicratatoskr apart is command-and-control. it does not call home to a server you can block by ip.

it joins yggdrasil, a decentralized mesh network with end-to-end encrypted ipv6 traffic, where every node holds an ed25519 key pair and derives its address from that key. eset calls this the first documented case of a state-aligned actor abusing yggdrasil this way. this is not your father's hack.

on september 17, 2025, the destructive phase landed, and it was almost insultingly ordinary. the wiper was sdelete, a sysinternals secure-delete utility microsoft makes available for legitimate administrators.

voodoo bear pushed it across the environment through the victim's own active directory group policy object (gpo). no bespoke wiper, no exotic payload. it is living-off-the-land tradecraft taken to its logical and nihilistic conclusion.

the connective tissue across the operation is trust. almost every major component of the attack borrowed something defenders already had a reason to allow. the larger trick was making trusted infrastructure carry hostile intent.