Russia-linked hackers hide inside volunteer network to wipe data at Ukrainian grain firm

Cybersecurity firm ESET says Russia-linked hackers used the volunteer-run Yggdrasil network to hide their communications during an attack on a Ukrainian grain logistics company. It is the first documented use of the technology by a state-linked hacking group. The attack ended with the destruction of data at the company, which is part of Ukraine's vital agricultural export sector.

Researcher Anton Cherepanov traced the July 2025 intrusion to a phishing email, sent as part of an ongoing campaign against logistics firms, grain companies and port terminals in Ukraine. The attackers installed software that let them remotely control infected computers, browse files, take screenshots and steal documents. That software talked to a server hidden inside Yggdrasil, an experimental network with no central owner. "Because it's a mesh network, it's harder to detect," Cherepanov said.

After gaining administrator privileges, the attackers used SDelete, a legitimate Microsoft tool designed to permanently erase files. Microsoft told Reuters that such tools can be misused by criminals who already have access to a network. ESET attributed the initial access to a group known as UAC-0099, while the data destruction bore the hallmarks of Sandworm, which is widely linked to Russian military intelligence. ESET could not determine what the affected systems were used for or confirm whether grain operations were disrupted.