Russian hackers destroyed data belonging to a Ukrainian grain logistics company after remaining undetected in its computer systems for two months. To control infected devices, the attackers used previously unknown malware that communicated with a server through the decentralized Yggdrasil network.
Cybersecurity researchers at ESET found that two hacking groups linked to Russian interests were behind the attack. They included Sandworm, which Western intelligence agencies have identified as a unit of Russia’s GRU military intelligence service.
The breach began on July 16, 2025. According to ESET, initial access was obtained by the group UAC-0099, which sent an employee a phishing email containing a malicious attachment.
After the file was opened, a loader called MATCHBOIL and a remote-access tool called MATCHWOK were installed on the computer. The next day, July 17, the hackers deployed another program that had not previously been known to cybersecurity researchers.
The researchers named the new malware “MythicRatatoskr.” It allowed the attackers to execute commands on infected computers, browse files, take screenshots, transfer documents, and redirect network connections.
Unlike conventional malware that communicates with servers using publicly accessible internet addresses, MythicRatatoskr connected to its command-and-control server inside Yggdrasil, an experimental decentralized network in which devices exchange encrypted data without a central coordinating authority.
The setup makes it more difficult to identify a command-and-control server and disrupt the attackers’ infrastructure. ESET said this was the first case it had documented of a state-linked hacking group using Yggdrasil in this way.
Yggdrasil itself, however, is not designed to provide anonymity, as its developers note. Even so, researchers had difficulty determining the server’s physical location.
On Sept. 17, 2025, two months after the initial intrusion, the hackers destroyed data on the company’s systems using the SDelete utility, launched through a mechanism that allows commands to be executed centrally across computers on a corporate network. ESET attributed this part of the operation to Sandworm with high confidence.
Researchers also said with high confidence that UAC-0099 had handed the compromised access over to Sandworm. They were unable, however, to determine which of the two groups operated MythicRatatoskr. The name of the affected company and the extent of the damage have not been disclosed.
ESET had already reported attacks by Sandworm against Ukraine’s grain sector in November 2025. At the time, the company said the group had deployed data-wiping malware against Ukrainian government organizations, energy and logistics companies, and businesses in the grain industry. Researchers said those operations appeared to be intended to weaken the Ukrainian economy.
Sandworm has been linked to Military Unit 74455 of Russia’s Main Intelligence Directorate, better known as the GRU. In 2020, the U.S. Justice Department charged six officers from the unit over a range of cyber operations, including the development of the NotPetya malware, attacks on Ukraine’s power grid, and attacks targeting computer systems used by the 2018 Winter Olympics.
The Insider subsequently identified additional information about members of the hacking group and confirmed that several of those charged were connected to Military Unit 74455.
In May 2026, in an investigation into the training of GRU hackers at Bauman Moscow State Technical University, The Insider identified two more graduates of the university’s military training center who had served in Military Unit 74455: Alexei Kondrashov and Ilya Boikov.
