Hackers Use Mesh Network to Hide Backdoor

A new backdoor linked to the Sandworm group uses the Yggdrasil mesh network to hide its command servers from security teams.

Security researchers at ESET have uncovered a new, sophisticated backdoor they named MythicRatatoskr. The malware is linked to the notorious Russian state-sponsored group Sandworm, also tracked as UAC-0099, which is known for highly disruptive cyberattacks. The report details how the backdoor was used as a stepping stone for a destructive attack against a Ukrainian grain company, highlighting the immediate real-world threat it poses. Written in the Go programming language, MythicRatatoskr distinguishes itself with a novel technique for hiding its communications: it uses the Yggdrasil mesh network to conceal its command and control (C&C) server. This discovery reveals a significant new tactic in the arsenal of one of the world's most dangerous threat actors, presenting a fresh challenge for defenders.

The key innovation of the MythicRatatoskr backdoor is its use of Yggdrasil for C&C communications. Yggdrasil is a decentralized, end-to-end encrypted mesh network that provides a unique IPv6 address to each node, independent of its physical location or underlying network. By embedding its C&C server within this network, the attackers create a resilient and anonymous channel that is incredibly difficult to track or shut down. Traditional security measures often rely on identifying and blocking specific IP addresses or domain names associated with malicious servers. With Yggdrasil, there is no central server or fixed IP to block. The traffic is fully encrypted, making it blend in and resist inspection, forcing security tools to find new ways to identify malicious activity beyond simple network signatures.

This tactic represents a logical, if concerning, evolution in threat actor tradecraft. For years, advanced groups have sought to obscure their C&C infrastructure. They have moved from static IP addresses to fast-flux DNS, and then to using legitimate services like social media platforms, cloud storage, or content delivery networks to relay commands. Using anonymity networks like Tor or I2P has also been common. The choice of Yggdrasil is a clever pivot to a less-monitored alternative. While Tor traffic often raises red flags for security teams, Yggdrasil is a more niche protocol that may not be on their radar. Sandworm's adoption of this technique demonstrates their continuous effort to stay ahead of defenders by exploiting emerging technologies and network protocols that lack widespread monitoring and established detection patterns.

For security teams and IT leaders, the emergence of MythicRatatoskr is a clear signal that threat landscapes are constantly shifting. Relying on traditional indicators of compromise, such as IP and domain blocklists, is no longer sufficient. This development underscores the growing need for comprehensive network visibility and behavioral analysis. Defenders must now consider monitoring for the presence of unusual or unauthorized network protocols like Yggdrasil within their environments. The ability to detect anomalies in network traffic, rather than just matching known bad signatures, becomes paramount. As this technique is proven effective, security professionals should anticipate that other threat actors will adopt similar methods, making proactive threat hunting and protocol-level network analysis essential components of a modern defense strategy.

The use of Yggdrasil for command and control is a significant evolution in evasion tactics. It creates a decentralized, encrypted, and hard-to-trace communication channel, forcing security teams to develop new detection methods beyond traditional IP and domain blocklists.

This new backdoor represents a heightened risk for critical infrastructure and other high-value targets. The advanced evasion techniques mean attacks can go undetected longer, increasing the potential for significant data destruction, operational disruption, and financial loss.