How VOODOO BEAR Wiped a Grain Firm Using Microsoft Tools
At 06:59 on July 16, 2025, a scheduled task called pdfopentask woke up inside a Ukrainian grain company and ran a line of PowerShell from a file named temporarydoc.txt. Nothing about it looked like the opening move of a military operation. It was a document task, a temp file, and a company moving wheat and corn rather than state secrets. Sixty-three days later, the company’s own management plane was weaponized against itself, pushing a free Microsoft utility across the environment to erase its data.
ESET published the full account on October 22, 2026, and it reads less like a single intrusion than a relay race. One Russia-aligned threat actor broke in and held the ground for weeks. A second, far more dangerous one arrived at the end to burn it all down. The notable part is not that Russia wiped another Ukrainian target. It is how cleanly the labor was divided, and what the group in the middle was running to stay hidden. This is why attribution is at once exceedingly important and incredibly difficult.
The group that opened the door is tracked by Ukraine’s CERT-UA as UAC-0099, a Russia-aligned espionage activity cluster active since at least 2022. It was first reported publicly in June 2023, with a history against Ukrainian government, finance, and media targets. ESET assesses with high confidence that UAC-0099 handled initial access and can operate as an initial access broker for a heavier hand.
That heavier hand is VOODOO BEAR, also known as Sandworm across the industry, the GRU’s destructive adversary linked to Unit 74455 and to a decade of wiper campaigns and power-grid attacks against Ukraine. ESET places the September 2025 destruction on VOODOO BEAR with high confidence and assesses the UAC-0099 to VOODOO BEAR handoff with high confidence as well. It holds only moderate confidence on UAC-0099’s Russia alignment, and it declines to name with any confidence who actually operated the new backdoor sitting between the two. ESET’s Anton Cherepanov called the specific pairing unusual, and the pattern itself no longer surprising.
The timeline is the reason this lands now rather than as history. The intrusion itself ran across the summer of 2025, more than a year before ESET pieced it together and brought it public, presenting at LABScon in September and Virus Bulletin in October. A command-and-control method live in the wild that long ago is only now documented, which means anyone else using it has had a year of cover, and probably still does.
The way in was rather dull yet effective. A spear-phishing email carried a malicious attachment, consistent with CERT-UA’s own findings. No exploit, no edge-device CVE, no clever zero-day. A person opened a document, and the pdfopentask scheduled task fired the first payload at 06:59.
Roughly a minute later, the downloader ESET calls MATCHBOIL pulled a backdoor named MATCHWOK from egyptanimals[.]com, with command-and-control at uztickets[.]com. Persistence was a registry Run key value, UpdateMonitor, the kind of entry hiding in plain sight on any Windows host.
The intrusion deepened the next morning. On July 17 at 09:28 the attackers delivered a previously undocumented backdoor to the same machine, with ESET assessing at high confidence that MATCHWOK led directly to it. From there they pushed copies to other machines over an OpenSSH SFTP server, and in August stood up a SOCKS5 proxy, bindProxy, to burrow deeper into the network. For all the talk of elite state hacking, the glamour here was a user clicking an attachment and a scheduled task doing the heavy lifting.
That new backdoor is the reason this report matters beyond one wiped grain company. MythicRatatoskr is written in Go, built on the open-source yggstack project, and carries the usual field kit, command execution, file transfer, screenshots, and proxying. It runs as a Windows service named ieupdate, hides behind filenames like updater.exe and WindowsDefenderSvc.exe, and decrypts its configuration with a hardcoded AES-256-CFB key. ESET puts its development window between December 2024 and February 2025. This was purpose-built, not improvised.
What sets MythicRatatoskr apart is command-and-control. It does not call home to a server you can block by IP. It joins Yggdrasil, a decentralized mesh network with end-to-end encrypted IPv6 traffic, where every node holds an Ed25519 key pair and derives its address from that key. The malware embeds 32 public peers and joins through three chosen at random. It generates a fresh Yggdrasil key on every run, so the infected host’s IPv6 address changes each time the service starts. The real command server lives inside the mesh and is reached over HTTPS on port 443 using JSON POST requests in four message types, check-in, tasking, result, and getfile. ESET calls this the first documented case of a state-aligned actor abusing Yggdrasil this way. This is not your father’s hack.
For defenders the implication is uncomfortable. Monitoring built around spotting suspicious outbound connections to known attacker infrastructure gets a lot less useful when the infrastructure is a peer-to-peer overlay riding inside encrypted IPv6. The saving grace is that Yggdrasil was built for resilience, not anonymity. ESET mapped the network on October 11, 2025, and the practical mitigation is blunt. Block the 32 public peer addresses embedded in the malware, then hunt for the published host artifacts, service names, binaries, and associated network behavior.
The name deserves an aside, because it is a trap. It invites you to assume the Mythic C2 framework. It is not that. ESET traces it to Ratatoskr, the squirrel of Norse myth that scurries up and down Yggdrasil, the world tree, carrying messages between the eagle at the top and the serpent at the roots. Someone in this toolchain has a classics habit and a sense of humor about running a mesh backdoor through a mythological tree. Cherepanov also noted indications that a Linux variant may exist, so this is unlikely to be a one-off.
On September 17, 2025, the destructive phase landed, and it was almost insultingly ordinary. The wiper was SDelete, a Sysinternals secure-delete utility Microsoft makes available for legitimate administrators. VOODOO BEAR pushed it across the environment through the victim’s own Active Directory Group Policy Object (GPO). Consider that for more than a moment. No bespoke wiper, no exotic payload. The GRU erased a company’s entire estate using Microsoft’s very own utility, and the company’s own management plane to deliver it. It is living-off-the-land tradecraft taken to its logical and nihilistic conclusion.
It is also vintage VOODOO BEAR. ESET’s November 2025 reporting tied the group to destructive attacks across Ukrainian government, energy, logistics, and grain organizations between June and September 2025, with Group Policy Object already a recurring delivery mechanism in its destructive operations. This grain firm was one target in a season of them.
The connective tissue across the operation is trust. Initial execution came through an email attachment. Persistence hid inside ordinary Windows operations. Lateral movement and command-and-control leaned on OpenSSH, a public Yggdrasil mesh, Active Directory Group Policy Object, and finally a legitimate Sysinternals utility. Almost every major component of the attack borrowed something defenders already had a reason to allow. The custom backdoor was novel. The larger trick was making trusted infrastructure carry hostile intent.
The target choice is not incidental, and this is where the keyboard work meets the war. Ukraine is one of the world’s largest exporters of wheat, corn, barley, and sunflower oil. Agriculture is a pillar of its export revenue and foreign currency, which makes it a pillar of the money keeping the country in the fight. The Food and Agriculture Organization of the United Nations (FAO), the UN agency tracking global crop production and trade, still forecast roughly 40 million tonnes of Ukrainian cereal exports for the 2025/26 marketing year. This is despite a war already constraining the transport and storage needed to move all that product.
It is also a pillar of other people’s food supply, since import-dependent regions across North Africa, the Middle East, and parts of Asia buy Ukrainian grain. Russia has treated that dependency as a pressure point for years. It walked out of the Black Sea Grain Initiative in July 2023 and has repeatedly struck port and grain infrastructure at Odesa and along the Danube with missiles and drones.
Wiping a grain logistics firm extends the same pressure off the quayside and into the network. Degrade the systems scheduling, tracking, and moving grain, and you degrade export revenue, rattle buyers, and reach for leverage over global food prices without firing a single shot at the silo. ESET notes the grain sector had been targeted by wipers before, but remained a less frequent target than other Ukrainian sectors. That makes this a deliberate extension of destructive pressure into a quieter part of their economy rather than a stray hit. The GRU has evidently decided the back office of a grain trader is a legitimate front.
Step back and the operation is novel on one axis and strategically revealing on another. On tradecraft, the Yggdrasil abuse is the first of its kind by a state-aligned actor, quietly breaking the assumption that command-and-control infrastructure will always look like legit infrastructure. On organization, it resembles the specialization model familiar from eCrime. UAC-0099 gets in and holds the ground. VOODOO BEAR arrives for the destructive finish. ESET does not establish a criminal-style market relationship between them, but the operational logic is familiar. Specialization scales.
An espionage foothold can no longer be filed as the lesser problem, because the group living quietly in your network today may simply be holding the door open for the group really wanting to torch the building tomorrow. A GRU wiper reaching a grain company through a borrowed foothold, an experimental mesh network, and a Microsoft utility is not a freak event. It is the operating model.
VOODOO BEAR did not need a better wiper. It needed control of the systems already trusted to administer the network. Once it had that, the company could be made to destroy itself.
The payload was ordinary. The intent was military.
