Russian Hackers Hid a Backdoor Inside a Network Nobody Can Shut Down, Then Wiped a Ukrainian Grain Company

Two Russian hacking crews ran a relay against a Ukrainian grain logistics company in 2025. The first broke in and planted a brand new backdoor. The second, Sandworm, wiped the company's machines two months later.

The detail that stands out is where the backdoor called home. Its command server sat inside Yggdrasil, an experimental decentralized network with no central server for anyone to seize or switch off. Slovak security firm ESET laid out the case in a research report published October 22, after presenting it at LABScon in September and Virus Bulletin earlier this month.

A phishing email, then a new backdoor

The break in started on July 16, 2025. A group called UAC-0099, first identified by Ukraine's CERT-UA in 2023 and assessed by ESET to be Russia aligned, sent the company, which ESET does not name, a spearphishing email with a malicious attachment. It led to the group's known downloader and backdoor.

The next day a new binary arrived. ESET researchers Anton Cherepanov and Peter Strycek named it MythicRatatoskr, a previously unknown backdoor written in Go that later spread to other machines in the company. It can run commands, move files, take screenshots and act as a proxy.

"We have not seen the backdoor used anywhere else, and we found indications that a Linux variant may also exist," Cherepanov said in ESET's announcement. ESET does not know which of the two groups actually operated it.

A server with no address to raid

Yggdrasil is a legitimate open source project, an experimental routing scheme that carries end to end protected IPv6 traffic between nodes. It was not built for criminals. But hosting a command server inside it made the server's physical location particularly hard to find, ESET says.

Because the network has no central operator, nobody can shut down one server to disrupt it, The Next Web notes. It does not anonymize users either, so devices can still be traced. ESET says that, to its knowledge, it is the first documented case of a state aligned threat actor abusing Yggdrasil this way. Where an organization has no use for the network, ESET suggests blocking connections to its public peers.

Sandworm pulls the trigger

On September 17, 2025, about two months after the first email, data was wiped across the company. The attackers used SDelete, a legitimate Microsoft tool for permanently deleting files, and pushed it out through the company's own Group Policy settings. ESET says it has seen that playbook from Sandworm numerous times and attributes the wipe to the group with high confidence.

Sandworm is tied to GRU Unit 74455 of Russian military intelligence, the unit behind some of the most destructive cyberattacks on record. ESET assesses that UAC-0099 can act as an initial access broker for it, handing off a foothold it has already won. That kind of teamwork is becoming a pattern: earlier in 2025 ESET caught Russia aligned Gamaredon working alongside Turla.

Grain as a target

The choice of victim fits the war. Before the full scale invasion, agriculture was about a fifth of Ukraine's economy and nearly half of its exports, and Russian forces have attacked Ukrainian ports and grain storage. ESET had already linked Sandworm to wiping attacks on Ukrainian agriculture, energy and transport companies in mid 2025.

Both sides are hitting each other's economies, and Kyiv has resumed strikes on Russian oil refineries. The grain company case shows the same fight running through corporate networks, now with infrastructure defenders cannot take offline.

Some offers on this page may be paid placements or contain affiliate links.