Cybersecurity researchers at ESET have identified the use of a decentralised, volunteer-operated network to conceal communications during a destructive cyberattack against an unnamed Ukrainian grain logistics company, in what the firm described as its first documented observation of a state-linked hacking group abusing the network in this way.
The attack began in July 2025, when a Russia-linked hacking group gained access to the company’s systems through a phishing email containing a malicious attachment.
The intruders installed software for remote control, collected documents and screenshots, and ultimately wiped data from the company’s systems on September 17, 2025, according to Reuters’ report on ESET’s findings, published on October 22, 2026.
ESET attributed the destructive phase to Sandworm, a hacking group widely associated with Russian military intelligence and known for cyberattacks against Ukrainian infrastructure.
Researchers believe a separate Russia-linked group obtained the initial access before control passed to Sandworm, although they could not conclusively establish which group operated the newly identified malware.
The attackers used Yggdrasil, an experimental peer-to-peer mesh network that allows participating devices to communicate through decentralised routing rather than relying on a single, centrally controlled server.
According to ESET, the malware’s command-and-control server was hosted within the network, making it more difficult for defenders to identify and disrupt the infrastructure through conventional methods.
The investigation uncovered a previously unknown backdoor, which ESET named MythicRatatoskr. Researchers found that the attackers deployed the malware on July 17, 2025, a day after the initial compromise. It could execute commands remotely, navigate the file system, transfer files, capture screenshots and proxy network connections.
ESET linked the initial intrusion to UAC-0099, a group associated with cyberespionage operations targeting Ukrainian organisations. Researchers identified the MATCHWOK backdoor among the tools used during the initial-access phase, providing evidence for their attribution. They assess that UAC-0099 may have transferred access to Sandworm, which later carried out the data-wiping operation.
However, the researchers could not conclusively determine who operated MythicRatatoskr. The attribution of the initial compromise to UAC-0099 and the destructive activity to Sandworm does not establish which group controlled the newly discovered backdoor throughout the intrusion.
The decentralised network’s role is significant because Yggdrasil does not depend on one central server to route communications. Its encrypted connections and mesh architecture can complicate efforts to trace malicious traffic or disable command-and-control infrastructure.
The network itself is legitimate software; its use in this incident involved the concealment of communications by the attackers.
ESET described the incident as the first documented case it had identified of a state-linked threat actor using Yggdrasil in this manner. The finding does not establish that no other hacking group has ever misused the network.
The victim company was not identified, and the available reporting did not establish whether the attack disrupted its grain logistics operations or quantify the damage caused by the data destruction.
Discover more from Aree Blog
Subscribe now to keep reading and get access to the full archive.
