Russian hacker groups used decentralized mesh network to wipe Ukrainian grain firm's data

Two Russia-linked hacking groups worked together to breach a Ukrainian grain logistics company in July 2025 and destroy its data two months later, using a previously unknown piece of malware that concealed its communications inside a decentralized volunteer-run network, cybersecurity firm ESET said in a report published Thursday.

ESET researchers Anton Cherepanov and Peter Strýček said the intrusion began on July 16, 2025, when a group tracked as UAC-0099 sent a spearphishing email with a malicious attachment to the unnamed company, triggering the execution of an initial backdoor called MATCHWOK.

The following day, the attackers deployed a second, previously undocumented tool the researchers named MythicRatatoskr — a Go-based backdoor that communicated with its command-and-control server through Yggdrasil, an experimental decentralized mesh network in which device-to-device traffic is end-to-end encrypted with no central hub.

"Because it's a mesh network, it's harder to detect," Cherepanov said, according to a Reuters wire report. "They abused this legitimate tool," he said of SDelete, a Microsoft utility the attackers later used to permanently erase files from affected machines.

ESET said UAC-0099 then handed access to Sandworm, which carried out the data-wiping attack on Sept. 17, 2025, deploying SDelete across the network via Active Directory Group Policy — a method consistent with Sandworm's known tactics. ESET attributed Sandworm to GRU Unit 74455, Russia's military intelligence service, and assessed that UAC-0099 is aligned with Russian interests. The firm said it could not determine which group primarily operated MythicRatatoskr, and it declined to identify the victim company.

"We have not seen the backdoor used anywhere else, and we found indications that a Linux variant may also exist," the researchers said.

ESET said the Yggdrasil abuse is without precedent in documented state-linked attacks. "To our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor, and it may signal a broader trend of adversaries adopting experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure," the researchers said.

UAC-0099 has been active since at least 2022 and was first reported by Ukraine's CERT-UA in June 2023. ESET said the group has targeted Ukrainian government agencies, financial institutions, and media. The collaboration between the two groups fits a pattern ESET has observed more broadly: earlier in 2025, the firm found that Russia-aligned Gamaredon had collaborated with Turla, another FSB-linked group.

"A UAC-0099-to-Sandworm handoff is unusual in the specific actors involved, but no longer surprising as a pattern," the researchers said.

ESET said it could not confirm whether the attack disrupted grain operations. The firm presented its findings on MythicRatatoskr at the LABScon conference on Sept. 18, 2026, and at Virus Bulletin on Oct. 16, 2026.