ESET says Russia-linked hackers used decentralised network in Ukraine attack

ESET says Russia-linked hackers used the volunteer-run Yggdrasil network to conceal communications during an attack on a Ukrainian grain logistics company. The attack ended with company data being wiped in September 2025.

The attackers gained access to the company’s systems in July 2025 through a phishing email with a malicious attachment, according to Slovakia-based cybersecurity firm ESET. They later installed software that let them remotely control compromised computers, browse files, take screenshots and steal documents. Data was wiped from the company’s systems on September 17, 2025.

This is reported by Reuters .

ESET attributed the data destruction to Sandworm, a hacking group widely linked to Russian military intelligence and previously blamed for cyberattacks on Ukrainian and Polish power grids. The malicious software communicated through a server concealed inside Yggdrasil, an experimental network run by volunteers with no central owner. ESET said this was the first documented use of such a network by a state-linked group.

Researchers said the technique could make hacking operations harder to identify and disrupt because decentralised networks do not rely on a single centrally controlled server. ESET believes one Russia-linked hacking group gained initial access before handing control to Sandworm, but said it could not determine which group operated the newly identified malware. The firm did not name the victim company.

Before the war, agriculture accounted for roughly a fifth of Ukraine’s economy and nearly half its exports, according to research estimates. Russia has targeted the sector throughout the conflict, bombing ports, grain elevators and fields.

We recommend paying attention to:

The anonymous Sikilik hacker group claims it breached Russia’s election infrastructure and contractors shortly before the State Duma vote.

Russian guided bombs struck Zaporizhzhia, killing one person and injuring 14, including a child and a police officer. Rescue work has ended, while city crews continue repairs.