Plan ahead High Monitor
New backdoor hid its control server in Yggdrasil network before attack on Ukrainian grain firm
ESET WeLiveSecurityfood, agriculture
What happened. ESET researchers found MythicRatatoskr, a previously unknown Go-based backdoor that hides its command-and-control server inside the Yggdrasil mesh network. It paved the way for a destructive attack on a Ukrainian grain firm, in a UAC-0099 and Sandworm collaboration.
Who is affected. A Ukrainian grain firm was attacked. The report does not name other affected organisations.
What to do. Review ESET's research for indicators of compromise and search your systems for them. Brief your team on this backdoor.
When to act. Plan ahead: review your exposure to the same entry point
Editor's reading
ForOT security leaddetection engineerIT security
- Purdue level
- L4
Why: The report gives no network detail; the backdoor is assumed to start on enterprise hosts (L4) before a destructive attack on the firm.
- Are you exposed?
Search network logs for traffic to Yggdrasil mesh nodes and check hosts for the indicators listed in ESET's report.
- If you cannot fix it yet
- Block Yggdrasil mesh network traffic at the enterprise and OT network boundaries unless it is needed.
- Restrict outbound connections from business and OT-adjacent hosts to approved destinations.
- Watch for
- Outbound connections to Yggdrasil mesh network nodes from business or OT-adjacent hosts.
- Unknown Go-based executables running on hosts, especially ahead of destructive activity such as mass file deletion.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: ESET WeLiveSecurity (opens welivesecurity.com)
More on Food and agriculture