Russia-linked hackers used decentralised network in Ukraine cyberattack, ESET says

By Leo Marchandon

Oct 22 (Reuters) - Russia-linked ‌hackers used the ​volunteer-run Yggdrasil ​network to conceal communications during an attack on a Ukrainian grain logistics company, marking the first documented use of the technology by a state-linked hacking group, ‌cybersecurity firm ESET said on Thursday.

The attack culminated in the destruction of ⁠data at the company, which forms part of Ukraine's vital agricultural export sector. Agriculture accounted for roughly a ‌fifth of Ukraine's economy and nearly ‌half its exports before the war, according to research estimates.

ESET traced the July 2025 intrusion to a phishing email sent as part of an ongoing campaign targeting logistics firms, ​grain companies and port terminals in Ukraine, researcher Anton Cherepanov said.

The attackers installed software that allowed them to remotely control infected computers, browse files, take screenshots and steal documents. ⁠The software communicated through a server hidden inside Yggdrasil, an experimental volunteer-run network with no central owner.

"Because it's a mesh network, ​it's harder to detect," Cherepanov said. ESET said it had not previously observed state-linked attacks using the network.

After gaining administrator privileges, the attackers ​activated a data-wiping tool that deleted data from affected ‌computers, Cherepanov said. The tool used was SDelete, a legitimate Microsoft utility designed to permanently erase files.

"They abused this legitimate tool," he said.

"SDelete is ⁠a legitimate, publicly available administrative utility that IT professionals use to securely delete data. Like many legitimate tools, it can be misused by malicious actors who have already gained access to a network," a ⁠Microsoft spokesperson told Reuters in an email.

ESET said it could not determine what the affected systems were used ​for and could not confirm whether the attack disrupted grain operations.

The initial intrusion was carried out by a Russia-linked hacking group known as UAC-0099, which ESET said specialises in gaining access to networks. The subsequent ‌data destruction bore the hallmarks of Sandworm, a hacking group widely linked to Russian military intelligence and previously blamed for cyberattacks on Ukrainian ‌and Polish power infrastructure.

ESET assessed that UAC-0099 successfully gained access and handed it to Sandworm, but said ⁠it could not determine which group ‌operated the previously unseen backdoor ​used between the breach and the data destruction.

The firm declined to identify the victim company.

(Reporting by Leo Marchandon in Gdansk; Editing by Matt Scuffham and ‌Joyjeet Das)

---

Serious News for Serious Traders! Try StreetInsider.com Premium Free!

---

You May Also Be Interested In

• Salvadoran families demand fair trials, mourn prison dead on Day of the Dead
• Countries reach COP17 deal to speed up biodiversity action, but money still short
• Canada advancing its 'middle power' strategy with new trade deals, Anand says