ESET says Russia-linked hackers hid malware traffic in Yggdrasil network

ESET linked hackers to Russia, using a decentralised network to hide their malware during an attack on a Ukrainian grain company.

The security company says it is the first documented case of a state-linked hacking group using the Yggdrasil network in this way.

The findings were published on Thursday in a new ESET report. The company also did not identify the victim.

The attack began on 16 July 2025, when hackers sent a phishing email designed to trick an employee into opening the door to the company’s systems.

ESET attributed the initial intrusion to a group known as UAC-0099, which Ukraine’s cyber emergency response team, CERT-UA, first identified in 2023.

The attackers installed two pieces of malware. The following day, they added another, a backdoor ESET named MythicRatatoskr. It let them run commands on infected computers, steal files, and take screenshots.

Two months later, on 17 September, the attackers wiped data across the company’s computers. The attackers used SDelete, a legitimate tool for permanently deleting files, and distributed it through the company’s own network settings.

ESET said it is highly confident that Sandworm carried out the destructive part of the attack. Western governments have linked Sandworm to Russia’s military intelligence agency, the GRU.

ESET believes UAC-0099 gave Sandworm access, although researchers could not determine which group operated the MythicRatatoskr backdoor.

The unusual part of the attack was how the malware communicated with its operators. Instead of relying on a conventional central server, it used Yggdrasil, an encrypted network that allows devices to communicate directly across the internet.

Because Yggdrasil has no central operator, ESET said authorities or security teams can’t shut down a single server to disrupt the network.

The project remains experimental, however, and does not anonymise its users. Devices using it can still be traced.

“To our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor,” ESET researchers said.

ESET has found no evidence that MythicRatatoskr has been used in other attacks, researcher Anton Cherepanov told The Record.

Ukraine’s agricultural sector has been a frequent target of Russian attacks. Before the full-scale invasion, agriculture accounted for around a fifth of the country’s economy and nearly half of its exports.

Russian forces have also attacked Ukrainian ports and grain storage facilities.

ESET has previously linked Sandworm to data-wiping attacks against Ukrainian agricultural, energy and transport companies in mid-2025.

Ukraine can also seek help through the EU’s emergency cyber reserve, an arrangement agreed in June that allows the country to access additional cybersecurity support during large-scale attacks.