Russian hacking groups have attacked a Ukrainian grain logistics company. The attackers used the decentralized “Yggdrasil” network to hide their connection to malware, and later destroyed data on the companyʼs computers.
This is stated in a report by cybersecurity company ESET.
According to researchers, on July 16, 2025, the “UAC-0099” group infiltrated the companyʼs systems via a phishing email with a malicious attachment. The next day, the hackers installed the “MythicRatatoskr” program, which allowed them to remotely control infected computers, execute commands, view files, take screenshots, and transfer documents.
The program’s command and control server was hosted on “Yggdrasil”, a decentralized network with no central control center. This structure can make it difficult to detect malicious activity. According to ESET, this is the first documented case of a state-linked hacking group using the network in this way.
About two months after the initial intrusion, the attackers destroyed the data on the affected computers. Researchers attribute this part of the attack to the “Sandworm” group, which has been linked to Russian military intelligence. The hackers used a legitimate “Microsoft” tool called “SDelete” to delete the data.
ESET believes that “UAC-0099” accessed the systems and passed it on to “Sandworm”. However, researchers were unable to determine which group was operating the “MythicRatatoskr” tool between the intrusion and the data destruction.
For more news and in-depth stories from Ukraine, please follow us on X.