Russian Hackers Deploy Unconventional Tech to Strike Ukrainian Grain Logistics Company

State-backed Russian hackers compromised a Ukrainian grain logistics company, leveraging the decentralized Yggdrasil network to obscure malicious software traffic before destroying corporate data, as reported by Reuters.

Cybersecurity firm ESET reported that the group UAC-0099 gained initial system access and deployed the custom MythicRatatoskr backdoor, later handing off control to Sandworm to execute the wiping attack using SDelete, according to Babel .

We bring you stories from the ground. Your support keeps our team in the field.

The breach began on July 16, 2025, when the hacking group UAC-0099 gained access through a phishing email containing a malicious file.

On July 17, the attackers installed the MythicRatatoskr remote access program to execute commands, view files, capture screenshots, and extract documents.

Roughly two months after the initial intrusion, the attackers wiped the data on the compromised computers. Researchers attributed the destructive phase of the attack to Sandworm, a group linked to Russian military intelligence, which deployed Microsoft's legitimate SDelete utility to execute the wipe.

According to ESET, UAC-0099 secured the initial foothold before handing control over to Sandworm. However, analysts were unable to confirm which specific group operated the MythicRatatoskr software during the interval between the initial breach and the destruction of the data.

This initiative was part of a broader strategy where Russian authorities diverted toys, school textbooks, and video games to transform an entire generation into future military workers and drone operators.

To support this effort, the government allocated significant budgets to equip hundreds of schools and colleges with 3D printers, flight simulators, and FPV drones, while even kindergartens began introducing preschool children to piloting basics.

this article: