Russia-linked hackers used decentralised network in Ukraine cyberattack, ESET says
MSFT•Russia-linked hackers used the volunteer-run Yggdrasil network to conceal communications during an attack on a Ukrainian grain logistics company, ESET said. The attack culminated in data destruction, though ESET could not confirm whether grain operations were disrupted.
1. Attack on logistics company
ESET traced the July 2025 intrusion to a phishing email targeting Ukrainian logistics firms, grain companies and port terminals. The attackers used software to control infected computers and steal documents, communicating through a server hidden inside Yggdrasil, an experimental volunteer-run mesh network.
2. Data was destroyed
After gaining administrator privileges, the attackers used SDelete, a legitimate Microsoft utility, to delete data from affected computers. Microsoft said the publicly available tool is used by IT professionals to securely delete data but can be misused by malicious actors who have already gained network access.
3. Groups linked to attack
ESET attributed the initial intrusion to Russia-linked UAC-0099 and said the subsequent data destruction bore the hallmarks of Sandworm, a group widely linked to Russian military intelligence. ESET assessed that UAC-0099 gained access and handed it to Sandworm, but could not determine which group operated the backdoor. The firm did not identify the victim company.
