Russia-linked hackers used the volunteer-run Yggdrasil network to conceal communications during an attack on a Ukrainian grain logistics company, marking the first documented use of the technology by a state-linked hacking group, cybersecurity firm ESET said on Thursday, Reuters reported.
The attack culminated in the destruction of data at the company, which forms part of Ukraine's vital agricultural export sector. Agriculture accounted for roughly a fifth of Ukraine's economy and nearly half its exports before the war, according to research estimates cited by Reuters.
ESET traced the July 2025 intrusion to a phishing email sent as part of an ongoing campaign targeting logistics firms, grain companies and port terminals in Ukraine, researcher Anton Cherepanov said. The attackers installed software that allowed them to remotely control infected computers, browse files, take screenshots and steal documents, with the software communicating through a server hidden inside Yggdrasil, an experimental volunteer-run network with no central owner.
"Because it's a mesh network, it's harder to detect," Cherepanov said. ESET said it had not previously observed state-linked attacks using the network. After gaining administrator privileges, the attackers activated a data-wiping tool using SDelete, a legitimate Microsoft utility designed to permanently erase files. "They abused this legitimate tool," he said.
In its fuller account, Reuters said ESET attributed the data destruction, on September 17, 2025, to Sandworm, a hacking group widely linked to Russian military intelligence and previously blamed for cyberattacks on Ukrainian and Polish power grids. That attribution is ESET's assessment, reported by Reuters; ESET said it believed one Russia-linked group gained initial access before handing control to Sandworm, although it could not determine which group operated the newly identified malware.
ESET said it could not determine what the affected systems were used for and could not confirm whether the attack disrupted grain operations. It did not identify the victim company. Microsoft did not immediately respond to a request for comment, Reuters said.
ESET says this is the first documented case of a state-linked group hiding its communications inside a decentralised volunteer network — a technique that could make future hacking operations harder to identify and disrupt.