Science & Tech · Cybersecurity · 6 hrs ago
Russia-linked hackers used mesh network in destructive Ukraine attack
Russia-linked hackers broke into an unnamed Ukrainian grain logistics company in July 2025, using a phishing email to gain access.
ESET says UAC-0099 later handed access to Sandworm, which carried out a data-wiping attack on September 17.
Before the wipe, the attackers used a previously undocumented backdoor linked to Yggdrasil, an experimental volunteer-run network with no central owner.
The network may make communications harder to detect, and ESET described this as the first documented use of Yggdrasil by a state-linked hacking group.
The attackers used Microsoft's legitimate SDelete tool to erase data from affected computers.
ESET could not determine what the systems were used for or whether the attack disrupted grain operations, and its accounts differ on which group operated the backdoor.
A destructive cyberattack targeting a Ukrainian grain logistics company used the Yggdrasil mesh network to conceal communications, according to cybersecurity firm ESET.
ESET said the attack began with a phishing email sent by Russia-linked group UAC-0099 in July 2025.
UAC-0099 later transferred access to Sandworm, which deployed the SDelete data-wiping utility in September 2025.
The attackers used a previously undocumented backdoor called MythicRatatoskr to communicate through a server hosted inside Yggdrasil.
ESET said it could not confirm whether the attack disrupted grain operations or identify the victim company.
- Who
- Russia-linked group UAC-0099 gained initial access; ESET assessed that it handed access to Sandworm.
- What
- Attackers used a new backdoor and Yggdrasil mesh network before wiping data with SDelete.
- When
- The intrusion began July 16, 2025; the data-wiping attack took place September 17, 2025.
- Where
- A Ukrainian grain logistics company. ESET declined to identify the company.
- Why
- Not stated.
This story does not have two clearly opposing sides.
UAC-0099 gained initial access to the target through a spear-phishing email.
The Hacker News reported that MythicRatatoskr was deployed a day after the MATCHWOK backdoor.
Sandworm carried out the data-wiping attack using SDelete.
iTnews, The Hacker News and SC Media published reports on the attack.
- Target
- Ukrainian grain logistics company; victim not identified
- Initial access
- July 16, 2025, via spear-phishing
- Initial access actor
- UAC-0099, also known as Earth Sirrush
- Backdoor
- MythicRatatoskr communicated through a server hosted inside Yggdrasil
- Destructive attack
- September 17, 2025; SDelete deployed through Active Directory Group Policy
- Impact
- ESET could not confirm whether grain operations were disrupted
3 sources
What people are saying
Because it's a mesh network, it's harder to detect.
They abused this legitimate tool.
To our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor, and it may signal a broader trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure
SDelete is a legitimate, publicly available administrative utility that IT professionals use to securely delete data. Like many legitimate tools, it can be misused by malicious actors who have already gained access to a network