Executive assessment and key judgments

This investigative report aims to conduct a deep technical, geopolitical, and strategic analysis of recently reported cyber operations involving the exploitation of the Yggdrasil decentralized network by Russia-linked threat actors against a Ukrainian grain logistics enterprise. Based on primary threat intelligence disclosures by ESET, analysis of OSINT data by Shieldworkz and corroborating security reporting, this evaluation examines the methods, operational implications, and wider threat patterns facing global critical infrastructure and enterprise environments.

Core analytical judgments

1. First-Documented Decentralized C2 Abuse (Confirmed): State-linked threat actors specifically identified via a handoff between initial-access cluster UAC-0099 and destructive operator Sandworm (associated with Russian military intelligence, the GRU) utilized Yggdrasil, an experimental, peer-to-peer (P2P) encrypted mesh network, to mask command-and-control (C2) traffic. This is the first verified instance of a state-aligned actor leveraging a decentralized, volunteer-run network topology to evade traditional edge-firewall and domain-sinkhole disruption. Masking of command and control traffic could have multiple implications for critical infrastructure operators. We will delve into these aspects in later part of this article.

2. Actor Handoff Convergence (Confirmed): The intrusion demonstrates a structured operational handoff model where initial access actors (UAC-0099) penetrate networks via spear-phishing, establish a foothold, and subsequently transfer operational control to specialized destructive units (Sandworm) for long-term pre-positioning and eventual data wiping via tools like SDelete.

3. Strategic Targeting of Logistics and Food Security (Confirmed): The selection of an agricultural grain logistics firm underscores the expansion of Russian cyber operations into supply-chain choke points, economic infrastructure, and export-dependent sectors critical to global food security. When seen in the background of recent attacks on utilities and super market chains in the Netherlands and France, this could be an attempt by hackers acting in unison to create a very large scale supply chain disruption in Europe and other geographies. We are seeing the emergence of a new playbook that covers multiple sectors, countries and threat actors.

4. Defensive Paradigm Shift (Analytical Inference): The abuse of legitimate P2P mesh architectures invalidates traditional indicators of compromise (IoCs) tied strictly to static IPs and domain names. Security architectures must evolve from perimeter blacklisting to anomalous overlay-network detection and behavioural telemetry analysis.

Incident fact sheet and evidence-quality assessment

Reconstructing the reported activity

ESET's October 22, 2026, disclosure confirms this sequence: UAC-0099 gained initial access to a Ukrainian grain logistics company on July 16, 2025, using a spear-phishing email with a malicious attachment. MATCHWOK was involved in the initial execution chain; MythicRatatoskr was deployed the following day and communicated with a C2 server hosted inside Yggdrasil. ESET subsequently observed a data-wiping operation on September 17, 2025, which it attributed to Sandworm with high confidence.

Chronological timeline

• July 16, 2025: Threat actors belonging to cluster UAC-0099 gain initial access to the target Ukrainian grain logistics network via a targeted phishing email vector. (The timing is important here as there is pressure on food-related supply chains due to the ongoing war in Ukraine.)

• July 17–July 18, 2025: Secondary payloads and bespoke backdoors, specifically identified as MythicRatatoskr, are deployed to establish sustained remote command execution, file theft, and screenshot capabilities.

• July–September 2025: Operational handoff occurs from initial access brokers to the destructive Sandworm group. The actors leverage the Yggdrasil mesh routing network to tunnel encrypted traffic directly through or into the compromised environment, bypassing conventional C2 edge inspection.

• September 17, 2025: Sandworm executes a coordinated destructive phase, deploying SDelete (a legitimate utility repurposed for malicious wiping) to permanently erase corporate data and disrupt logistical tracking.

• October 2026: ESET publicly discloses the technical mechanics of the campaign, highlighting the pioneering abuse of decentralized protocols.

Technical Attack-Path Model

1. Initial Access: Spear-phishing email containing malicious attachments or links delivered to corporate endpoints.

2. Execution & Tooling: Deployment of initial loaders followed by the installation of the MythicRatatoskrbackdoor.

3. C2 Masking via Yggdrasil:

   • Yggdrasil builds an encrypted IPv6-based IPv6 packet network over existing public or local infrastructure using an end-to-end authenticated mesh.

   • By executing Yggdrasil client binaries on infected hosts, the adversary establishes an overlay network that requires no central command server or dynamic DNS provider.

   • Network traffic blends into encrypted P2P routing, rendering domain sinkholing and IP-based perimeter blocking ineffective, as there is no single upstream server to seize.

4. Lateral Movement and Persistence: Credential harvesting, internal reconnaissance, and administrative pivoting.

5. Payload Delivery and Destruction: Execution of Microsoft SDelete to wipe critical databases, file shares, and operational servers.

Threat actor attribution and operational intent

Attribution Assessment

• Assessed actor: Sandworm (GRU unit 74455 / VSRF) via initial provisioning support from UAC-0099.

• Confidence level: Moderate-High.

• Evidence base: Overlapping Tactics, Techniques, and Procedures (TTPs) (including overlaps in IOCs), historical preference for permanent data destruction in Ukraine, and specific forensic markers tying infrastructure handover protocols to known Russian military intelligence operations.

• Alternative explanations: While the tools and techniques align closely with Sandworm, proxy staging or false-flag tradecraft cannot be entirely dismissed; however, the strategic objective of agricultural disruption strongly correlates with Russian wartime state goals.

Strategic context: Why this activity matters

The operation against a grain logistics provider reflects a broader Russian strategic doctrine that treats economic, logistical, and agricultural nodes as legitimate components of total warfare. Ukraine accounts for a massive share of global grain and agricultural exports. By targeting logistics management systems, grain silos, and transport coordinators, cyber operations serve as a force multiplier for physical kinetic blockades, impacting supply chains, international commodity pricing, and food security across the Global South and Europe.

The distinctive technical feature of this intrusion was the use of Yggdrasil as the network environment hosting the MythicRatatoskr command-and-control server. Yggdrasil creates an encrypted IPv6 overlay across participating peers, allowing communication without relying on a single conventional, centrally managed C2 server.

This architecture complicates some established disruption techniques. Domain-based blocking may be ineffective against communications that do not depend on conventional domain resolution, while blocking an individual peer may not eliminate connectivity across the wider mesh.

However, decentralization does not make the communication inherently invisible, anonymous, or immune to network controls. ESET notes that Yggdrasil is not designed to provide anonymity. Organizations can still restrict unauthorized software, control outbound connectivity, inspect available network and endpoint telemetry, and investigate unexpected overlay-network activity.

The defensive implication is not that perimeter security has become obsolete. It is that infrastructure-based indicators should be complemented by process-level, identity-aware, and behavioral detection.

Security teams should investigate whether an endpoint is unexpectedly running a mesh-network client, which process launched it, what privileges it has, which peers it contacts, whether its traffic is permitted by policy, and whether the activity coincides with suspicious file access or remote command execution.

Cross-campaign analysis: What patterns are emerging?

Investigating the AI dimension: Capability, evidence, and operational risk

The available reporting and our analysis does not establish that AI was used to develop MythicRatatoskr, operate the Yggdrasil-backed command-and-control infrastructure, or coordinate the transition between UAC-0099 and Sandworm.

But we can infer based on previous Shieldworkz research that AI could assist comparable operations through reconnaissance, phishing-content generation, malware-development support, analysis of collected information, and automation of selected operational tasks. AI could also be used to plan a multi-stage campaign and develop psychological profiles of target employees. These remain potential capabilities rather than demonstrated characteristics of this incident.

The more important defensive question is whether AI-assisted activity changes the signals that security teams can observe. Behaviors such as process execution, unauthorized software installation, privileged access, network connections, and destructive file operations remain observable when linked telemetry is available. Other behaviors may be difficult to distinguish from legitimate activity or may escape detection when monitoring is incomplete.

Shieldworkz recommends that security teams prioritize behavior-based detection, identity and endpoint telemetry correlation, network-egress enforcement, and tested response procedures rather than attempting to determine whether an adversary used AI from the apparent sophistication of an attack.

• Observed AI Usage in Yggdrasil Incident: There is no credible empirical evidence indicating that artificial intelligence or large language models were utilized to engineer the Yggdrasil backdoor (MythicRatatoskr) or orchestrate the UAC-0099/Sandworm handoff.

• Plausible Future Risks: Adversaries are increasingly positioned to leverage AI for rapid vulnerability triage, localized spear-phishing content generation at scale, and automated post-compromise log parsing. However, fundamental network-layer behavior (such as binary execution of unauthorized mesh daemons like Yggdrasil) remains detectable via endpoint telemetry and process execution auditing, regardless of whether AI assisted in writing the initial dropper.

Enterprise, government, supply-chain, and OT exposure analysis

• Identity & Access: Compromise of administrative credentials remains the primary vehicle for lateral movement. Privileged accounts lacking phishing-resistant MFA present immediate vectors.

• Enterprise IT & Overlay Networks: The adoption of decentralized tools (Yggdrasil, Tor, I2P, Tailscale/ZeroTier abuse) by threat actors allows them to bypass traditional perimeter firewalls. Security teams must monitor for unauthorized execution of mesh networking binaries.

• Industrial & OT Boundaries: While this specific incident targeted IT-based grain logistics management, enterprise-to-OT conduits represent a critical high-risk bridge. A compromised logistics IT system can corrupt inventory manifests, billing systems, and automated loading schedules.

Defensive framework: From intelligence to detection and resilience

Prevent

• Application Control & Binary Whitelisting: Implement strict software restriction policies (e.g., AppLocker, Defender Application Control) to block unauthorized execution of mesh networking binaries and tools like Yggdrasil.

• Phishing-Resistant MFA: Enforce FIDO2/WebAuthn-based multi-factor authentication across all enterprise and remote-access portals.

Detect

• Behavioral Endpoint Monitoring: Write detection rules targeting the execution of decentralized network clients, abnormal raw socket creation, and unusual IPv6 tunneling interfaces.

• Telemetry Correlation: Monitor process execution chains where office productivity applications spawn command interpreters (cmd.exe, powershell.exe) followed by network daemon initialization.

Respond and Recover

• Isolated Incident Playbooks: Maintain air-gapped backup verification procedures and predefined network segmentation triggers to sever compromised IT segments instantly upon detecting wiper activity.

Standards, frameworks, and regulatory mapping

Security KPIs and KRIs

Metric Name	Definition	Calculation	Target	Accountable Owner
Unauthorized Binary Block Rate	Percentage of unauthorized network tool executions successfully blocked by endpoint controls.	To calculate the percentage of blocked executions compared to total attempted executions, multiply the former by 100.		Endpoint Security Lead
Privileged MFA Coverage	Proportion of privileged accounts secured via phishing-resistant hardware tokens.	(Secured Privileged Accounts + Total Privileged Accounts) × 100		Identity & Access Management Team

Distinctive findings and original analytical contribution

The primary analytical contribution of this investigation is highlighting the operational transition from traditional client-server C2 infrastructure to trustless, decentralized overlay networks (Yggdrasil) by state-sponsored actors. Traditional threat intelligence models rely heavily on IP blocklists and domain takedowns. The integration of volunteer-run mesh networks breaks this paradigm, proving that sophisticated groups are shifting toward resilient, serverless communications that completely neutralize traditional perimeter mitigation strategies.

Prioritized recommendations and 30/60/90-day roadmap

• First 30 Days (Immediate Risk Reduction): Audit endpoint software baselines to detect and prohibit unapproved VPN, tunneling, and mesh networking tools (including Yggdrasil, ZeroTier, and Tailscale). Verify immutable offsite backup integrity.

• Days 31–60 (Detection Engineering): Deploy custom Sigma and EDR detection rules targeting unusual IPv6 mesh network daemon execution and unexpected outbound raw socket connections.

• Days 61–90 (Resilience & Governance): Conduct red-team simulation exercises focusing on decentralized C2 evasion techniques and validate cross-functional incident response handoffs between IT and security operations.

Days 1–30: Establish exposure and control

·       Inventory authorized overlay-network, policies and tunneling software.

·       Restrict unauthorized software execution and outbound connectivity.

·       Review privileged access, policy permissions, and critical logging gaps.

·       Verify backup isolation, integrity, and recovery prerequisites.

Days 31–60: Validate detection

·       Implement and test process/network correlation rules.

·       Test unauthorized overlay execution and suspicious administrative distribution.

·       Validate file-destruction detections and response escalation.

·       Assess critical IT/OT conduits and vendor remote access where applicable.

Days 61–90: Prove resilience

·       Run authorized attack simulations against the relevant detection hypotheses.

·       Test recovery from destructive activity and verify restored data.

·       Exercise coordination between IT, SOC, incident response, engineering, and OT operations.

·       Report residual risk, untested controls, and remediation ownership to leadership.

Source register

1. The420.in (October 2026): Russia-Aligned Hackers Use Decentralised Network in Ukraine Cyberattack. https://the420.in/russia-hackers-yggdrasil-ukraine-grain-cyberattack-eset/]

2. The Next Web / Recorded Future News (October 2026): ESET says Russia-linked hackers hid malware traffic in Yggdrasil network. https://thenextweb.com/news/eset-russia-hackers-yggdrasil-ukraine-grain]

3. Ground News / ESET Intelligence Feed (October 2026): Aggregated technical reports covering the UAC-0099 and Sandworm handoff and MythicRatatoskr backdoor analysis.