Russia-linked hackers used decentralised network in Ukraine cyberattack, ESET says
ESET said the malware hid communications in Yggdrasil, a volunteer-run network, as attackers stole files and wiped data from the company.
- On Thursday, Slovakia-based cybersecurity firm ESET reported that Russia-linked hackers used Yggdrasil, a decentralized volunteer-run network, to conceal communications during a cyberattack on an unnamed Ukrainian grain logistics company.
- Attackers gained access to the firm's systems on July 16, 2025, through a phishing email; ESET researchers identified UAC-0099 as the group providing initial access before handing control to Sandworm.
- The hackers communicated through Yggdrasil, an experimental volunteer-run network with no central operator, which prevents authorities from shutting down a single server to disrupt the network.
- Sandworm, a group linked to Russia's military intelligence agency the GRU, wiped the company's data on September 17, 2025, using SDelete, a legitimate file-deletion tool.
- Ukraine's agricultural sector, which accounts for nearly half the country's exports, remains a frequent target of Russian attacks; ESET identified this as the first documented case of state-linked Yggdrasil abuse.
6 Articles
6 Articles
Russia-linked hackers used decentralised network in Ukraine cyberattack, ESET says
Russia-linked hackers used a decentralised volunteer-run network to conceal communications during an attack on a Ukrainian grain logistics company, marking the first documented case of a state-linked group using the network this way, ESET researchers said.
ESET says Russia-linked hackers hid malware traffic in Yggdrasil network
ESET linked hackers to Russia, using a decentralised network to hide their malware during an attack on a Ukrainian grain company. The security company says it is the first documented case of a state-linked hacking group using the Yggdrasil network in this way. The findings were published on Thursday in a new ESET report. The […] This story continues at The Next Web
ESET reported that hackers linked to Russia concealed malware communications in Yggdrasil during an attack on a Ukrainian grain company that ended with data deletion. The investigation distinguishes the initial intrusion from the destructive operation attributed with high confidence to Sandworm.
Coverage Details
Bias Distribution
- 80% of the sources are Center
Factuality
To view factuality data please Upgrade to Premium
