Russia-linked Hackers Employ Yggdrasil Network in Cyberattack on Ukraine

Russia-linked hackers have recently employed the volunteer-run Yggdrasil network to conceal their communications during a cyberattack on a Ukrainian grain logistics company. This incident is notable as it represents the first documented use of this technology by a state-linked hacking group, as reported by cybersecurity firm ESET.

The attack led to the destruction of data at the targeted company, which plays a vital role in Ukraine's agricultural export sector. Prior to the ongoing conflict, agriculture accounted for about a fifth of Ukraine's economy and nearly half of its exports, according to various research estimates.

ESET traced the intrusion back to July 2025, identifying a phishing email as part of a broader campaign aimed at logistics firms, grain companies, and port terminals within Ukraine. Researcher Anton Cherepanov noted that the attackers installed software that enabled them to remotely control infected computers, browse files, take screenshots, and steal documents.

The malicious software communicated through a server hidden within the Yggdrasil network, which is an experimental, decentralized network without a central owner. Cherepanov explained that the mesh nature of the network makes it more challenging to detect such activities. ESET indicated that it had not previously observed state-linked attacks utilizing this network.

Exploitation of Legitimate Tools by Hackers

After gaining administrator privileges, the hackers activated a data-wiping tool that deleted information from the compromised systems. The tool in question was SDelete, a legitimate Microsoft utility designed for the permanent erasure of files. Cherepanov pointed out that the attackers misused this legitimate tool for their malicious purposes.

A Microsoft spokesperson confirmed that SDelete is a publicly available administrative utility used by IT professionals to securely delete data, but it can be exploited by malicious actors who have already gained access to a network.

Clearance Granted

ESET was unable to ascertain the specific functions of the affected systems or confirm whether the attack disrupted grain operations. The initial breach was attributed to a Russia-linked hacking group known as UAC-0099, which specializes in infiltrating networks. The subsequent data destruction exhibited characteristics typical of Sandworm, a hacking group associated with Russian military intelligence and previously implicated in cyberattacks on Ukrainian and Polish power infrastructure.

ESET assessed that UAC-0099 successfully gained access to the network and subsequently handed it over to Sandworm. However, the firm could not identify which group operated the previously unseen backdoor that facilitated the breach and subsequent data destruction. The identity of the victim company has not been disclosed by ESET.