2 Hacker Groups Hid in Yggdrasil to Hit Ukraine Firm [2026]

ESET reported on October 22, 2026 that Russia-linked hackers hid malware command traffic inside Yggdrasil, a volunteer-run decentralized mesh network with no central owner, during an attack on a Ukrainian grain logistics company, marking the first documented use of Yggdrasil this way by a state-linked group. ESET researcher Anton Cherepanov said the intrusion began in July 2025 with a phishing email during a broader campaign against Ukrainian logistics firms, grain companies and port terminals; ESET attributed the initial intrusion to UAC-0099 and the destructive data-wiping activity to Sandworm, which is widely linked to Russian military intelligence, and said it believed UAC-0099 handed access to Sandworm but could not determine which group operated the newly identified malware. The case matters because a server inside Yggdrasil offers defenders no hosting provider, registrar or central address to seize or block.

Russia-linked hackers hid their malware traffic inside Yggdrasil , a volunteer-run network with no central owner, during an attack on a Ukrainian grain logistics company, The Next Web reported https://thenextweb.com/news/eset-russia-hackers-yggdrasil-ukraine-grain on October 22, 2026, citing research from security firm ESET. ESET called it the first documented use of Yggdrasil in this way by a state-linked hacking group. The Yggdrasil cyberattack matters because it shows how a hobbyist mesh network can shield command traffic from the tools most defenders rely on. The intrusion began in July 2025 with a phishing email, according to ESET researcher Anton Cherepanov. That email arrived during a wider campaign aimed at logistics firms, grain companies, and port terminals in Ukraine. Governments across Europe and Asia are now building teams to rehearse exactly this kind of operation, as our coverage of Japan’s AI attack simulation team https://shattered.io/japan-ai-cyberattack-simulation-team-php-flaws-2026/ showed earlier this month. This analysis walks through what ESET found, who did what, what the public reporting leaves out, and what security teams should change this quarter. It sticks to the confirmed record and flags every gap. Where we offer predictions, we label them as our own analysis rather than reported fact. Don't miss new tech stories on Google Add Shattered once in the Google app and our stories show up in your news suggestions. Add now https://www.google.com/preferences/source?hl=en&q=https%3A%2F%2Fshattered.io%2F What ESET Reported About the Yggdrasil Cyberattack ESET said Russia-linked hackers used Yggdrasil to conceal communications during a cyberattack on a Ukrainian grain logistics company. Reuters carried the story on October 22, and outlets including Business Today, The420.in, and Hiru News also covered it. The headline claim is narrow but significant. A state-linked group did not just use a rare tool. It routed its control channel through a network that nobody owns and nobody can switch off. The attackers’ software gave them remote control of infected computers. They could browse files, take screenshots, and steal documents. The malware did not phone home to a conventional central server. It talked to a server hidden inside the Yggdrasil network instead, which changed what defenders could see and block. ESET also tied the case to two named groups. It identified UAC-0099 as the group behind the initial intrusion and attributed the destructive data-wiping activity to Sandworm , a group widely linked to Russian military intelligence. The firm said it believed UAC-0099 handed access to Sandworm. It could not determine which of the two operated the newly identified malware. Insurance Journal carried the wire story under the headline Russia-Linked Hackers Used Decentralized Network in Ukraine Cyberattack https://www.insurancejournal.com/news/international/2026/10/23/890042.htm , which gives the clearest short summary of the claim for readers who want the original wire language. How Yggdrasil Works and Why Attackers Want It Yggdrasil is an experimental network run by volunteers. Machines join it and relay traffic for one another, so there is no company, data center, or registry sitting in the middle. That design suits privacy enthusiasts and hobbyists who want encrypted links between devices. It also suits attackers who want a command channel that no single authority can seize. A Mesh With No Owner Traditional malware infrastructure has a weak point. Defenders find the server, report it to a hosting provider or registrar, and the provider takes it down. Law enforcement can seize it. Threat intelligence feeds can list its address and let firewalls block it for every customer at once. A server inside Yggdrasil has none of those handles. There is no hosting company to call and no registrar to serve. What Defenders Lose Cherepanov, a principal malware researcher at ESET, explained the appeal in plain terms. ITnews quoted him saying that a mesh network is harder to detect. That short remark captures the trade. Blocklists, domain reputation scoring, and takedown requests all assume a fixed target. A mesh gives them none. None of this makes Yggdrasil malicious. It is an open project with legitimate users. The risk comes from the fact that its strengths, encryption and decentralization, work equally well for people hiding stolen data. Security teams now have to treat unexplained mesh traffic as a signal worth investigating, especially on servers that have no business running such software. The Attack Chain From Phishing Email to Data Wiping ESET traced the compromise to a phishing email sent during a campaign against Ukrainian logistics firms, grain companies, and port terminals. The email opened the door in July 2025. From there, the operators installed software that let them control machines remotely, browse files, capture screenshots, and pull out documents. One day after the initial access, according to ESET’s published research, the attackers deployed a new backdoor that talked to a command server hosted inside the Yggdrasil mesh. That sequence is worth pausing on. Within roughly a day, the intruders moved from a single user opening an email to a persistent channel that standard network monitoring could not easily attribute or block. The final stage was destructive. ESET attributed the data-wiping activity to Sandworm. The public reporting does not say how many systems lost data, how long recovery took, or whether the company kept operating. Those gaps matter, and we cover them in a later section. The entry point is the lesson defenders can act on today. Phishing remains the cheapest way into a logistics network, and a single click started this chain. Phishing-resistant sign-in reduces the damage a stolen password can do, and our 12-step passkey login tutorial https://shattered.io/how-to-create-a-passkey-webauthn-login-2026/ shows how to set it up. Passkeys would not have stopped a malicious attachment, but they close off the credential-theft route that often follows. UAC-0099 and Sandworm: Who Did What Two groups appear in ESET’s account, and they play different roles. UAC-0099, which ESET described as specializing in gaining access to networks, opened the door. Sandworm, widely linked to Russian military intelligence, carried out the destruction. ESET believes the first group passed access to the second. That handoff model, where one team sells or shares footholds and another monetizes or weaponizes them, has become a standard pattern in state-linked operations. | Actor or tool | Role in the case | ESET’s position | |---|---|---| | UAC-0099 | Initial access through a phishing email | Identified as the group behind the first intrusion, specializing in network access | | Sandworm | Destructive data-wiping activity | Attributed the wiping to the group, which is widely linked to Russian military intelligence | | Access handoff | UAC-0099 passing access to Sandworm | ESET believes it happened but frames it as an assessment | | New backdoor | Remote control, file browsing, screenshots, document theft | ESET could not determine which group operated it | | Yggdrasil | Hidden command server for the malware | First documented use of this kind by a state-linked group | The attribution gap deserves attention. ESET could say who gained access and who wiped data, but it could not say who held the keys in between. That window is where the backdoor ran and where documents were stolen. For defenders, the practical point is that the stages can involve different operators with different goals, so a quiet intrusion should never be treated as harmless. MythicRatatoskr: The Backdoor Hidden in the Mesh ESET named the new backdoor MythicRatatoskr. Researcher Peter Strýček explained the choice. In Norse mythology, Ratatoskr is the squirrel that runs messages up and down the world tree Yggdrasil, and the malware plays a similar messenger role inside the network. The name is a rare moment of humor in a grim report, but it also helps analysts search for the sample. According to Cherepanov, ESET has not seen the backdoor used anywhere else, and the firm found indications that a Linux variant may also exist. That second point should worry administrators of Linux servers, which often sit outside endpoint detection coverage. A Windows-only warning would leave them exposed. If a Linux build exists, the same hidden channel could reach file servers, web hosts, and cloud workloads in other sectors. The backdoor’s capabilities read like a standard espionage toolkit. It enabled remote control, file browsing, screenshots, and document theft. What set it apart was the transport, not the feature list. By tunneling through Yggdrasil, the authors avoided the single most common weakness in custom malware, which is a command server that can be found and burned. Because the sample appears rare, signature-based detection will lag. Behavior-based detection has a better chance. A process that creates an unusual virtual network adapter, opens encrypted peer connections, and then reads document folders is worth an alert regardless of its name. What ESET Researchers Said ESET and its researchers have described the case in several public statements. We quote them verbatim below, with the outlet that carried each remark. “Because it’s a mesh network, it’s harder to detect.” Anton Cherepanov, Principal Malware Researcher at ESET, as reported by ITnews “One day later, the attackers deployed MythicRatatoskr that communicates with a command-and-control server hosted inside the Yggdrasil mesh network.” Anton Cherepanov, Principal Malware Researcher at ESET, in ESET’s published research “We have not seen the backdoor used anywhere else, and we found indications that a Linux variant may also exist.” Anton Cherepanov, Principal Malware Researcher at ESET, in ESET’s published research “Given the backdoor’s role as a messenger scurrying through the Yggdrasil network, we decided to name the backdoor MythicRatatoskr.” Peter Strýček, ESET Researcher, in ESET’s published research “To our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor.” ESET researchers, as quoted by The Record from Recorded Future News https://therecord.media/ukraine-hackers-russia-grain-sandworm Read together, the statements show a careful research team. ESET stresses what it has seen and avoids claims about what it has not. Its wording on the Linux variant says “indications,” not proof, and its priority claim says “to our knowledge.” That caution is a good reason to trust the findings while remembering that the picture is still partial. What the Public Reporting Does Not Tell Us Several details remain unknown, and we will not guess at them. Reporters did not name the affected Ukrainian company. The coverage gives no count of compromised devices, stolen documents, or wiped systems. It also does not include a direct, on-the-record statement from the victim about operational impact. Readers should treat any outlet that supplies those numbers without a source with suspicion. | Question | Status in public reporting | |---|---| | Who built the network used to hide traffic? | Yggdrasil is an experimental, volunteer-run network with no central owner, and it was not built by the attackers | | When did the intrusion begin? | July 2025, according to ESET researcher Anton Cherepanov | | How did attackers get in? | A phishing email during a campaign against Ukrainian logistics firms, grain companies, and port terminals | | Which group wiped data? | Sandworm, per ESET’s attribution | | Which group ran the backdoor? | Undetermined, according to ESET | | Name of the victim company | Not disclosed | | Number of devices or documents affected | Not disclosed | The missing numbers limit any estimate of financial damage. A grain logistics firm sits between farms, ports, and buyers, so a wiping attack can stall shipments even when the data loss looks small on paper. Without a figure for affected systems, we cannot say how much stalled. We can only say that the sector is exposed and that the attackers chose a target with real downstream weight. Why Ukraine’s Grain Logistics Sector Is a Target ESET said the phishing campaign went after logistics firms, grain companies, and port terminals. That list reads like a map of the export chain. Grain moves from storage to transport to terminals to ships, and each step relies on software for scheduling, documentation, and customs paperwork. Disrupting any link slows the whole chain. Logistics companies also make attractive stepping stones. They hold shipping manifests, contracts, and contact lists that reveal how goods and money flow. Stolen documents from such a firm can feed espionage long after the wiping ends. The attackers’ toolkit, with screenshots and file theft, fits that goal as much as it fits sabotage. The420.in described the attackers as Russia-aligned hackers using a decentralized network, and its write-up https://the420.in/russia-hackers-yggdrasil-ukraine-grain-cyberattack-eset/ underlines the sector focus. Readers outside Ukraine should not file this under regional news. Any firm that moves physical goods for a living, from ports to warehouses to freight brokers, runs similar software and faces the same phishing pressure. Historical Context: Sandworm’s Long Run Against Ukraine Sandworm is no newcomer. The group has a long record of destructive operations against Ukrainian targets, and ESET’s latest case fits that history. What changes here is the plumbing, not the intent. Earlier destructive campaigns relied on conventional infrastructure. This one added a hidden transport layer. ESET also publishes broader tracking of Russian activity. Its separate APT activity report https://www.eset.com/gr-en/about/newsroom/press-releases-1/eset-research-apt-report-russian-cyberattacks-in-ukraine-intensify-sandworm-unleashes-new-destructive-wiper-1/ , titled to say that Russian cyberattacks in Ukraine intensify and that Sandworm unleashes a new destructive wiper, shows the pattern of rising tempo. That report is a different document from the grain case, so we do not merge their details here. The handoff structure has parallels elsewhere. Our earlier piece on a BeyondTrust zero-day that gave a China-linked APT 47 days https://shattered.io/beyondtrust-cve-2026-102764-china-apt-zero-day-2026/ described long, quiet dwell times before defenders noticed. The Ukrainian case shows the same discipline from a different state. Patient access first, damage later, and tooling chosen to avoid early detection. Yggdrasil Versus Tor and Conventional C2: A Comparison Attackers have several ways to hide command traffic. The table below compares three approaches on qualities that matter to defenders. It reflects general properties of each design rather than measured benchmarks from the ESET case. | Approach | Central owner | Takedown route | Blocklist value | Defender visibility | |---|---|---|---|---| | Conventional command server | Yes, a hosting provider or the attacker | Report to provider, registrar, or law enforcement | High, one address or domain can be listed | Good, traffic goes to a known endpoint | | Anonymity network such as Tor | No single owner, but relay lists are public | Hard to take down, but entry points can be blocked | Moderate, defenders can block known relays | Moderate, the protocol is well understood | | Yggdrasil mesh | No, volunteer-run and experimental | No central party to contact | Low, the server sits inside the mesh | Low, unfamiliar traffic that many tools do not profile | The comparison explains why the Yggdrasil cyberattack stands out. Tor has been watched by defenders for years, and many organizations simply block it. Yggdrasil is newer and smaller, so fewer products ship with rules for it. That gap will close over time, but attackers gain a window until it does. Market Impact: Vendors, Insurers, and Logistics Operators Nothing in the reporting points to a market reaction in listed shares, and we will not invent one. The effects are more likely to show up in product roadmaps and underwriting questionnaires. Network detection vendors now have a concrete reason to add mesh-network profiling. Endpoint vendors have a named backdoor to write detections for. Insurers watch cases like this closely. A wiping attack on a logistics firm tests policy language on destructive events and state-linked actors. Our look at Lockton’s warning of a £650M cyber-insurance gap https://shattered.io/lockton-650m-cyber-insurance-gap-fridge-hack-2026/ shows how wide the coverage questions already run. Add a hidden transport layer that complicates forensics, and claims teams will ask harder questions about evidence. Operators of physical supply chains face the sharpest pressure. When an attack hits a retailer’s systems, as in our report on the Ahold Delhaize cyberattack across US and EU stores https://shattered.io/ahold-delhaize-cyberattack-us-europe-stores-2026/ , the effects reach shelves within days. Grain logistics works the same way. Buyers and shippers will press suppliers for proof of recovery plans, offline backups, and incident response contracts. What Defenders Should Do Now The case gives security teams a short, concrete to-do list. None of it requires new products, and most of it is policy and logging work that pays off against many other threats. - Inventory mesh and overlay software. Search endpoints and servers for Yggdrasil and similar tools. Remove anything without a business owner. - Log new virtual network adapters. A process that creates an adapter and opens encrypted peer links deserves an alert. - Harden email first. The chain started with a phishing email. Detonate attachments in a sandbox and strip risky file types at the gateway. - Cover Linux. ESET found indications of a Linux variant, so extend detection to servers that lack endpoint agents. - Keep offline, tested backups. Wiping attacks make recovery the real defense. Test restores on a schedule. - Segment logistics systems. Keep scheduling, customs, and finance networks apart so one foothold cannot reach everything. Attackers rename binaries, so process names alone prove little. Still, a quick sweep finds careless deployments and legitimate installs you forgot about. The commands below are a starting point you should adapt to your environment. Linux: look for a running mesh process or a matching network adapter ps aux | grep -i yggdrasil ip -6 addr | grep -i ygg Windows PowerShell: look for a matching process or adapter Get-Process | Where-Object { $ .ProcessName -match 'yggdrasil' } Get-NetAdapter | Where-Object { $ .InterfaceDescription -match 'ygg' } Pair the sweep with threat intelligence. Check your feeds against the indicators ESET published, and track new additions to the CISA exploited-vulnerability list, such as the entries in our summary of four CISA KEV flaws in Palo Alto, Cisco, and Ahsay products https://shattered.io/cisa-kev-palo-alto-cisco-ahsay-four-flaws-october-2026/ . Our wider security coverage https://shattered.io/security/ tracks the other campaigns that hit the same sectors. Five Predictions From Our Analysis The following forecasts are our own analysis, not reported facts and not attributed to ESET or any named person. They follow from the confirmed details above. 1. Other groups will copy the technique. Once a method is public, criminal and state-linked actors adopt it quickly. Expect more malware that hides its command server inside peer-to-peer networks. 2. Security vendors will ship mesh-traffic detections. Network and endpoint products will add profiling for Yggdrasil and similar overlays within the next few quarters. 3. Some enterprises will block overlay networks by default. Policies that already ban Tor will expand to cover mesh tools without a documented business need. 4. The Linux variant will surface. ESET found indications it exists, so researchers will probably publish a sample, and administrators of Linux fleets will need new rules. 5. Logistics firms will face tougher insurance terms. Underwriters will ask more about backups, segmentation, and email defenses for firms that run port and freight systems. We hold the second and fourth predictions with the most confidence because they depend on vendor and researcher incentives that already exist. The first is likely but harder to date. The fifth depends on how the underlying claims play out. Our coverage of the FBI and CISA warning that SafePay ransomware hit 600 firms https://shattered.io/safepay-ransomware-fbi-cisa-advisory-600-firms-2026/ shows insurers already face heavy loss pressure from other threats. Frequently Asked Questions What is Yggdrasil? Yggdrasil is an experimental, volunteer-run network with no central owner. Devices that join it relay encrypted traffic for each other, so no single company runs the middle of the network. What did ESET find in the Yggdrasil cyberattack? ESET said Russia-linked hackers used Yggdrasil to conceal communications during an attack on a Ukrainian grain logistics company. The malware talked to a server hidden inside the network instead of a conventional central server. ESET called it the first documented use of Yggdrasil in this way by a state-linked hacking group. Which hacking groups were involved? ESET identified UAC-0099 as the group behind the initial intrusion and attributed the data-wiping activity to Sandworm, which is widely linked to Russian military intelligence. ESET believes UAC-0099 handed access to Sandworm. It could not determine which group operated the new malware. When did the attack begin and how did it start? The intrusion began in July 2025, according to ESET researcher Anton Cherepanov. The initial access came through a phishing email sent during a campaign against logistics firms, grain companies, and port terminals in Ukraine. What is MythicRatatoskr? MythicRatatoskr is the name ESET gave to the new backdoor. Researcher Peter Strýček said the name reflects the malware’s role as a messenger moving through the Yggdrasil network. ESET said it has not seen the backdoor used anywhere else. Which company was attacked and how much damage was done? The reporting does not name the company. It also gives no count of compromised devices, stolen documents, or affected systems, so any specific figure you see elsewhere should be treated as unverified. Is Yggdrasil itself malicious? No. It is an open, experimental network with legitimate users. The attackers abused its decentralized design, which also makes it a useful hiding place for malware traffic. How can organizations detect this kind of activity? Inventory overlay and mesh software, alert on unexpected virtual network adapters and encrypted peer connections, cover Linux servers, and harden email defenses. Behavior-based detection will work better than signatures for a backdoor this rare.