Russia-aligned hackers used an experimental decentralised network to hide their command infrastructure during a destructive cyberattack on a Ukrainian grain logistics company, according to cybersecurity firm ESET.
Researchers said the intrusion began with a targeted phishing email in July 2025 and later developed into an attack that deleted data from the victim’s systems.
ESET linked the initial compromise with hacking group UAC-0099 and said the destructive phase showed techniques associated with Sandworm, a group tied by Western governments and researchers to Russian military intelligence.
The affected Ukrainian company has not been publicly identified.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
Attack Began With a Phishing Email
ESET said attackers gained access to the grain logistics company on July 16, 2025.
The intrusion started with a spear-phishing email containing a malicious attachment.
Spear phishing is a targeted form of phishing in which attackers craft messages for a particular organisation or employee rather than sending the same email to thousands of people.
Opening the attachment led to the execution of malware known as MATCHWOK.
ESET attributes that stage of the operation with high confidence to UAC-0099, a group that has previously targeted Ukrainian government bodies, financial institutions, media organisations and industrial companies.
The researchers believe the group may act as an initial-access provider for other Russian-aligned operators.
One day after the first compromise, the hackers installed another previously undocumented backdoor that ESET named MythicRatatoskr.
That malware became particularly important because of the unusual network it used to communicate with attackers.
Hackers Hid Command Servers Inside Yggdrasil
MythicRatatoskr connected to its command-and-control server through Yggdrasil.
Yggdrasil is a decentralised mesh network that creates encrypted IPv6 connections between participating computers.
Unlike a traditional server setup, there is no single central network provider controlling the entire system.
That structure has legitimate uses.
But it can also make malicious infrastructure harder to trace, block or dismantle because communications can be routed through multiple participating nodes.
ESET said it had not previously observed MythicRatatoskr and found signs that a Linux version may also exist.
The backdoor can execute commands, navigate files, upload and download data, capture screenshots and proxy network traffic.
Researchers believe the attackers may have used it to create a SOCKS5 proxy inside the compromised network.
In simple terms, that would allow attackers to route their activity through infected systems, making their real location and infrastructure more difficult to identify.
Reuters said this appears to be the first documented use of Yggdrasil by a state-affiliated hacking operation.
Destructive Phase Came Months Later
The attack did not end with espionage.
Around two months after the original breach, attackers began deleting data from the victim’s systems.
ESET said the techniques used during this destructive stage were consistent with Sandworm.
Sandworm has been linked to Russian military intelligence unit 74455 and has a long history of disruptive attacks against Ukrainian organisations.
It has previously been associated with malware designed to erase information and interfere with critical infrastructure.
ESET believes UAC-0099 may have established access to the organisation before that access was later used in the destructive operation.
Researchers said such cooperation would not be unprecedented.
Both groups have repeatedly focused on Ukrainian organisations, and ESET assesses with medium confidence that UAC-0099 operates in support of Russian interests.
However, cybersecurity attribution is rarely absolute.
ESET’s findings are based on malware, infrastructure and attack techniques rather than direct evidence identifying individual operators.
Ukraine’s Grain Sector Remains a Strategic Target
The choice of victim is significant.
Ukraine is one of the world’s major grain exporters, and its agricultural and logistics infrastructure has been repeatedly affected by the war.
Cyberattacks against companies involved in moving grain can therefore have consequences beyond ordinary corporate data theft.
A logistics company may handle shipment records, customer information, transport schedules and documents needed to move agricultural products.
Destroying that information could interfere with operations even without damaging physical infrastructure.
Reuters said ESET could not determine whether grain shipments themselves were disrupted by the attack.
The incident nevertheless shows how cyber operations can target sectors with direct economic and strategic importance.
Decentralised Networks Create a New Defensive Problem
The use of Yggdrasil highlights another challenge for defenders.
Security teams traditionally look for connections between infected computers and suspicious internet servers.
If attackers instead hide those systems inside decentralised networks, blocking them can become more complicated.
Removing one server may not be enough if traffic can move through alternative nodes.
That could make peer-to-peer and mesh technologies increasingly attractive to sophisticated attackers.
The technology itself is not malicious.
But security teams may need to monitor unusual connections to decentralised networks just as closely as suspicious domains or IP addresses.
What this means for you:
The attack shows that advanced threat groups are experimenting with legitimate decentralised technologies to hide malicious infrastructure. Organisations should treat unexpected mesh-network traffic, targeted phishing and unusual proxy activity as potential warning signs of a deeper compromise.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
