ESET Uncovers ‘MythicRatatoskr’ Backdoor Used to Hit Ukrainian Grain Firm, Exposing Food‑Chain Cyber Risk
Researchers have identified a new Go‑based backdoor, MythicRatatoskr, hidden inside the Yggdrasil mesh network and deployed in a joint UAC‑0099/Sandworm operation against a Ukrainian grain company. The case shows how advanced Russian‑linked actors are aiming destructive attacks at agricultural infrastructure, not just power grids and government networks.
A newly disclosed hacking tool used in a disruptive cyberattack on a Ukrainian grain company is drawing attention to a front in the war that rarely makes the headlines: the digital security of the global food chain.
Security researchers at ESET say they have uncovered MythicRatatoskr, a previously unknown backdoor written in Go, that hides its command‑and‑control server inside the Yggdrasil mesh networking system rather than on a conventional internet host. The malware was deployed in what the researchers describe as a collaboration between threat clusters tracked as UAC‑0099 and Sandworm, the Russian‑linked group tied to past attacks on Ukrainian power infrastructure and other high‑impact targets.
According to the technical analysis, MythicRatatoskr was used to establish covert access into the network of a Ukrainian grain firm and prepare the ground for a destructive attack. By using Yggdrasil—a decentralized, encrypted mesh that routes traffic over a virtual IPv6 network—the operators made it significantly harder for defenders to trace or block their command infrastructure through normal domain‑ or IP‑based detection.
For the Ukrainian grain company and its staff, the operation was not about abstract code. It meant the systems that coordinate storage, processing, and shipment of grain were quietly being probed and manipulated with the intent to cause damage. Depending on the timing, even temporary disruption at a large facility can delay exports, spoil stored crops or create bottlenecks that ripple through railways and ports.
This focus on agricultural infrastructure fits a broader pattern of Russian‑aligned cyber activity against Ukraine, where attackers have repeatedly moved beyond headline‑grabbing power outages to target logistics, transport and now food production. In a country that is a key exporter of grain to parts of Africa, the Middle East and Asia, interference with agribusiness is not only an economic blow but a lever on global markets and food security.
From a technical standpoint, MythicRatatoskr shows how state‑backed or state‑tolerated groups are investing in command‑and‑control channels designed to evade the tools many enterprises still rely on. By embedding their control servers in a mesh network that’s not tied to one hosting provider or jurisdiction, they complicate takedown efforts and force defenders to look deeper into traffic patterns rather than just blocking a small set of bad addresses.
The case also underlines that in modern conflict, farmers, silo operators and grain traders can find themselves on the same target lists as energy executives and defense contractors. A single compromised grain firm can slow deliveries to multiple countries, tilt prices on sensitive markets and hand an aggressor another pressure point against both Ukraine and its customers.
Signs to watch include whether defenders in Ukraine and beyond begin reporting similar Yggdrasil‑based command infrastructures in other sectors, whether attribution of the operation is formally tied to Russian military intelligence, and how quickly agricultural companies upgrade their monitoring and incident response around industrial control systems. If MythicRatatoskr marks the start of a sustained campaign against agribusiness networks, the collateral damage could extend well past Ukraine’s borders and into food‑importing states that already face tight supplies.
Sources
- OSINT