UAC-0099 and Sandworm Deploy MythicRatatoskr Backdoor via Yggdrasil

Summary

Affiliates associated with INC and The Gentlemen ransomware groups are leveraging an AI-driven intrusion ecosystem to automate reconnaissance, command generation, and data triage. The operators use a custom framework called Phantom alongside commercial LLMs to support large-scale intrusions. The infrastructure was exposed after significant OPSEC failures revealed command-and-control servers and stored AI session data.

Investigation

The investigation started after researchers found an exposed command-and-control server at 45.227.254.43 hosting open directories containing Phantom source code and AI session databases. Analysis of exposed configuration files and credentials subsequently uncovered six additional adversary-controlled servers. Researchers identified a highly automated workflow in which AI performs much of the technical execution while human operators maintain oversight.

Mitigation

Organizations should prioritize patching edge systems, especially FortiClient EMS, SimpleHelp, and cPanel, to close common initial access paths. Enforcing multi-factor authentication (MFA) across RMM, VPN, and remote access platforms is essential to reduce credential reuse risk. Defenders should also enable EDR tamper protection and monitor for unauthorized termination of security services or loading of known vulnerable drivers.

Response

When malicious activity is identified, isolate affected edge devices and audit administrative accounts in EMS and RMM platforms for unauthorized additions. Review VPN connection scripts for suspicious changes and rotate compromised credentials immediately. Conduct a thorough examination of scheduled tasks and active reverse SOCKS tunnels to identify and terminate persistent C2 channels.

Simulation Execution

• Attack Narrative & Commands: The adversary aims to establish persistence on the target host using the MythicRatatoskr backdoor. To simulate the detection, the attacker will perform three distinct actions: 1) Execute a command containing the specific “MATCHWOK backdoor” string to trigger selection1; 2) Drop a malicious binary at the highly specific path C:windowssystem32updater.exe to trigger selection2; and 3) Create a new Windows Service named WindowsDefenderSvc.exe to trigger selection3. This mimics the multi-stage deployment where initial access leads to high-privilege persistence.

• Regression Test Script:

  # Simulation Script for MATCHWOK/MythicRatatoskr Detection Validation
  # NOTE: This script must be run with Administrator privileges.
  
  Write-Host "[*] Starting Simulation..." -ForegroundColor Cyan
  
  # 1. Trigger Selection 1: CommandLine contains 'MATCHWOK backdoor'
  Write-Host "[+] Triggering Selection 1 (Command Line)..." -ForegroundColor Yellow
  Start-Process cmd.exe -ArgumentList "/c echo This is a simulation of the MATCHWOK backdoor execution" -WindowStyle Hidden
  
  # 2. Trigger Selection 2: Image is 'C:windowssystem32updater.exe'
  Write-Host "[+] Triggering Selection 2 (File Path)..." -ForegroundColor Yellow
  $targetPath = "C:WindowsSystem32updater.exe"
  if (Test-Path $targetPath) { Remove-Item $targetPath -Force }
  New-Item -Path $targetPath -ItemType File -Force | Out-Null
  Start-Process $targetPath -ArgumentList "/silent" -ErrorAction SilentlyContinue
  
  # 3. Trigger Selection 3: ServiceName is 'WindowsDefenderSvc.exe'
  Write-Host "[+] Triggering Selection 3 (Service Name)..." -ForegroundColor Yellow
  $serviceName = "WindowsDefenderSvc.exe"
  # Creating a dummy service that runs 'cmd.exe'
  New-Service -Name $serviceName -BinaryPathName "C:WindowsSystem32cmd.exe /c echo persistence" -DisplayName "Windows Defender Security Service" -StartupType Manual
  
  Write-Host "[*] Simulation Complete." -ForegroundColor Green

• Cleanup Commands:

  # Cleanup Script
  Write-Host "[!] Cleaning up simulation artifacts..." -ForegroundColor Red
  
  # Remove the service
  Stop-Service -Name "WindowsDefenderSvc.exe" -ErrorAction SilentlyContinue
  sc.exe delete "WindowsDefenderSvc.exe"
  
  # Remove the malicious file
  Remove-Item "C:WindowsSystem32updater.exe" -Force -ErrorAction SilentlyContinue
  
  Write-Host "[*] Cleanup Finished." -ForegroundColor Green