ESET Links Yggdrasil-Hidden Backdoor to Destructive Ukraine Grain Attack

Russia-aligned hackers used the volunteer-run Yggdrasil network to conceal communications during an attack on a Ukrainian grain logistics company, cybersecurity firm ESET said. Reuters reported that the intrusion ended with data destruction, although ESET could not determine whether the incident disrupted grain operations or identify the victim.

A phishing email opened the door

ESET said UAC-0099 gained access on July 16, 2025, through a spearphishing email with a malicious attachment. The group used known MATCHBOIL and MATCHWOK malware before deploying MythicRatatoskr, a previously unknown Go-based backdoor whose command-and-control server was hidden inside Yggdrasil.

Yggdrasil is a decentralized mesh network with encrypted IPv6 communication between nodes. Its design can make command traffic harder to detect than communications tied to a conventional centralized server. The backdoor supported command execution, file navigation and transfer, screenshots and proxying.

ESET assesses a handoff to Sandworm

ESET said UAC-0099 obtained the initial access and later handed it to Sandworm, a group attributed to Russia’s GRU Unit 74455. The destructive phase, observed about two months later, used SDelete, a legitimate Microsoft utility abused to erase files. ESET attributed that phase to Sandworm with high confidence based on the tactics, techniques and procedures.

The firm said it had not seen MythicRatatoskr used elsewhere and could not determine which group operated the backdoor between the initial breach and the wipe. Those limits matter: the report supports a collaboration assessment, not certainty about every operator or operational impact.

Illustrative file photo of software code on a monitor; it does not depict an attack or a system involved in this report. Photo: Markus Spiske / Unsplash. Unsplash License; cropped to 16:9. Image source; license.

Sources

Reuters report
ESET research