By Leo Marchandon
Oct 22 (Reuters) – Russia-linked hackers used a decentralised volunteer-run network to conceal communications during an attack on a Ukrainian grain logistics company, marking the first documented case of a state-linked group using the network this way, ESET researchers said.
The attack culminated in the destruction of data at the company in September 2025. Researchers say the technique could make hacking operations harder to identify and disrupt because decentralised networks do not rely on a single centrally controlled server.
Agriculture accounted for roughly a fifth of Ukraine’s economy and nearly half its exports before the war, according to research estimates, and Russia has targeted the sector throughout the conflict, bombing ports, grain elevators and fields.
Slovakia-based cybersecurity firm ESET said the attackers gained access to the company’s systems in July 2025 through a phishing email carrying a malicious attachment.
The attackers later installed software that allowed them to remotely control compromised computers, browse files, take screenshots and steal documents before data was wiped from the company’s systems on Sept. 17, 2025.
ESET attributed the data destruction to Sandworm, a hacking group widely linked to Russian military intelligence and previously blamed for cyberattacks on Ukrainian and Polish power grids.
The malicious software communicated through a server hidden inside Yggdrasil, an experimental volunteer-run network with no central owner, the first use of such a network that ESET has documented by a state-linked group.
ESET said it believed one Russia-linked hacking group gained the initial access before handing control to Sandworm, although it could not determine which group operated the newly identified malware.
The firm did not identify the victim company.
(Reporting by Leo Marchandon in Gdansk; Editing by Matt Scuffham)
