KYIV: Russia-linked hackers used the volunteer-run Yggdrasil network to conceal communications during an attack on a Ukrainian grain logistics company, marking the first documented use of the technology by a state-linked hacking group, cybersecurity firm ESET said on Thursday.
The attack culminated in the destruction of data at the company, which forms part of Ukraine’s vital agricultural export sector. Agriculture accounted for roughly a fifth of Ukraine’s economy and nearly half its exports before the war, according to research estimates.
ESET traced the July 2025 intrusion to a phishing email sent as part of an ongoing campaign targeting logistics firms, grain companies and port terminals in Ukraine, researcher Anton Cherepanov said.
The attackers installed software that allowed them to remotely control infected computers, browse files, take screenshots and steal documents. The software communicated through a server hidden inside Yggdrasil, an experimental volunteer-run network with no central owner.
“Because it’s a mesh network, it’s harder to detect,” Cherepanov said. ESET said it had not previously observed state-linked attacks using the network.
After gaining administrator privileges, the attackers activated a data-wiping tool that deleted data from affected computers, Cherepanov said. The tool used was SDelete, a legitimate Microsoft utility designed to permanently erase files.
“They abused this legitimate tool,” he said.
Microsoft did not immediately respond to a request for comment.
ESET said it could not determine what the affected systems were used for and could not confirm whether the attack disrupted grain operations.
The initial intrusion was carried out by a Russia-linked hacking group known as UAC-0099, which ESET said specializes in gaining access to networks. The subsequent data destruction bore the hallmarks of Sandworm, a hacking group widely linked to Russian military intelligence and previously blamed for cyberattacks on Ukrainian and Polish power infrastructure.
ESET assessed that UAC-0099 successfully gained access and handed it to Sandworm, but said it could not determine which group operated the previously unseen backdoor used between the breach and the data destruction.
The firm declined to identify the victim company.