Russia-linked hackers used the volunteer-run Yggdrasil network for the first time to conceal an attack on a Ukrainian grain logistics company, which culminated in the destruction of data with Microsoft's legitimate SDelete tool.
Cybersecurity firm ESET reported that Russia-linked hackers used the volunteer-run Yggdrasil network to conceal their communications during an attack on a Ukrainian grain logistics company, marking the first documented use of that technology by a state-linked hacking group.
The attack culminated in the destruction of data at the company, which forms part of Ukraine's vital agricultural export sector. Agriculture accounted for roughly a fifth of Ukraine's economy and nearly half its exports before the war, according to research estimates.
ESET traced the July 2025 intrusion to a phishing email sent as part of an ongoing campaign targeting logistics firms, grain companies and port terminals in Ukraine, researcher Anton Cherepanov said.
The attackers installed software that allowed them to remotely control infected computers, browse files, take screenshots and steal documents. The software communicated through a hidden server inside Yggdrasil, an experimental volunteer-run network with no central owner.
“Because it's a mesh network, it's harder to detect,” Cherepanov said. ESET said it had not previously observed state-linked attacks using that network.
After gaining administrator privileges, the attackers activated a wiping tool that deleted data from the affected computers, Cherepanov explained. The tool used was SDelete, a legitimate Microsoft utility designed to permanently erase files.
“They abused this legitimate tool,” he said.
Microsoft did not immediately respond to a request for comment.
ESET said it could not determine what the affected systems were used for and could not confirm whether the attack disrupted grain operations.
The initial intrusion was carried out by a Russia-linked hacking group known as UAC-0099, which according to ESET specializes in gaining access to networks. The subsequent data destruction bore the hallmarks of Sandworm, a group widely linked to Russian military intelligence and previously blamed for cyberattacks on Ukrainian and Polish power infrastructure.
ESET assessed that UAC-0099 successfully gained access and handed it to Sandworm, but said it could not determine which group operated the previously unseen backdoor used between the intrusion and the data destruction.
The firm declined to identify the victim company.
