Russia-linked UAC-0099 and Sandworm use Yggdrasil network and SDelete in destructive attack on Ukrainian grain logistics firm
ESET reports that Russia-linked actors used the decentralized Yggdrasil mesh network to hide command-and-control traffic during an attack on a Ukrainian grain logistics company in July 2025. ESET says this is the first documented use of the technology by a state-linked group. The intrusion began with a phishing email sent in a campaign against logistics firms, grain companies and port terminals in Ukraine, and ended with data destruction on the affected computers. ESET attributes the initial access to UAC-0099 and assesses that access was handed to Sandworm, which showed characteristics tied to the wiping stage. ESET could not determine which group operated the backdoor between the intrusion and the destruction. The victim was not named, and it is not confirmed whether operations were disrupted.
Detalhes técnicos
- Initial access: phishing email in a campaign targeting Ukrainian logistics, grain and port terminal organizations.
- After gaining access, the attackers installed a remote-control program that could browse files, take screenshots and steal documents.
- The program communicated through a server hidden on Yggdrasil, an experimental volunteer-run mesh network with no central owner. According to ESET researcher Anton Cherepanov, its mesh structure makes the traffic harder to detect.
- With administrator privileges, the attackers ran SDelete, a legitimate Microsoft utility for permanently deleting files, to destroy data.
- Attribution: UAC-0099 is blamed for the initial intrusion. The destructive stage showed traits associated with Sandworm, a group widely linked to Russian military intelligence and previously blamed for attacks on energy infrastructure in Ukraine and Poland.
Remediação
The article gives no specific remediation guidance.
Linha do tempo
-
Russia-linked UAC-0099 and Sandworm use Yggdrasil network and SDelete in destructive attack on Ukrainian grain logistics firm
ler a análise desta fonte ocultar
ESET reports that Russia-linked actors used the decentralized Yggdrasil mesh network to hide command-and-control traffic during an attack on a Ukrainian grain logistics company in July 2025. ESET says this is the first documented use of the technology by a state-linked group. The intrusion began with a phishing email sent in a campaign against logistics firms, grain companies and port terminals in Ukraine, and ended with data destruction on the affected computers. ESET attributes the initial access to UAC-0099 and assesses that access was handed to Sandworm, which showed characteristics tied to the wiping stage. ESET could not determine which group operated the backdoor between the intrusion and the destruction. The victim was not named, and it is not confirmed whether operations were disrupted.
Technical Details
- Initial access: phishing email in a campaign targeting Ukrainian logistics, grain and port terminal organizations.
- After gaining access, the attackers installed a remote-control program that could browse files, take screenshots and steal documents.
- The program communicated through a server hidden on Yggdrasil, an experimental volunteer-run mesh network with no central owner. According to ESET researcher Anton Cherepanov, its mesh structure makes the traffic harder to detect.
- With administrator privileges, the attackers ran SDelete, a legitimate Microsoft utility for permanently deleting files, to destroy data.
- Attribution: UAC-0099 is blamed for the initial intrusion. The destructive stage showed traits associated with Sandworm, a group widely linked to Russian military intelligence and previously blamed for attacks on energy infrastructure in Ukraine and Poland.
Remediation
The article gives no specific remediation guidance.