Russian Hackers Use Yggdrasil Network in Destructive Attack on Ukrainian Grain Firm

• •UAC-0099 exploited a phishing attack to access a Ukrainian grain company in July 2025.
• •MythicRatatoskr, a new backdoor, was used to facilitate remote commands and data theft.
• •The attack utilized the Yggdrasil network for malware communication, complicating detection efforts.

In July 2025, Russian state-linked hacking group UAC-0099 gained access to a Ukrainian grain logistics company via a phishing email. They installed a backdoor called MatchWok and later deployed a unique tool named MythicRatatoskr, which allowed remote command execution and file theft. In September 2025, the attackers executed a data-wiping operation using SDelete, a legitimate file deletion tool. ESET researchers reported this as the first known instance of a state-aligned actor using the Yggdrasil decentralized network to conceal malware communications. The attack highlights the ongoing threat to Ukraine's agricultural sector amidst the ongoing conflict. ESET has linked Sandworm, another Russian hacking group, to the destructive phase of the attack. The full scope of the impact remains unclear, as the victim company has not been identified. This incident reflects a broader trend of cyberattacks targeting critical infrastructure in Ukraine since the onset of the war.