Russia-linked hacking groups used a tool linked to the experimental Yggdrasil peer-to-peer network in an attack on a Ukraine grain logistics company, the first time the technology is known to have been used in this way, researchers ESET said.

The initial intrusion was attributed to a Russia-aligned hacking group known as UAC‑0099, which later handed off access to Sandworm, a separate hacking entity attributed to GRU Unit 74455, a unit within Russia’s GRU military intelligence wing.

One day following the initial intrusion on 16 July 2025, the attackers deployed a previously undocumented backdoor that ESET called MythicRatatoskr, which uses a command server located within the Yggdrasil experimental mesh network.

Data destruction

Access was eventually handed off to Sandworm, which conducted a data-wiping attack using Microsoft’s legitimate SDelete tool.

“We have not seen the backdoor used anywhere else, and we found indications that a Linux variant may also exist,” said researchers Anton Cherepanov and Peter Strýček in an advisory, referring to MythicRatatoskr.

Yggdrasil is a decentralised mesh network that uses an experimental routing scheme in which IPv6 communication between the nodes is end-to-end encrypted, making it “particularly challenging” to determine the server’s physical location.

Threat resilience

“To our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor,” the researchers wrote.

They speculated future attacks could use experimental peer-to-peer networks to increase the resilience and stealth of their infrastructure.

ESET said the use of MythicRatatoskr was attributable to either UAC-0099 or Sandworm, but couldn’t determine which.

The company didn’t indicate which organisation was affected and said it wasn’t able to determine whether the attack had an impact on Ukraine’s grain exports, which are critical to its economy.