Russia-linked hackers used a decentralized network to conceal communications during an attack on a Ukrainian grain logistics company, ESET researchers said. The attack, attributed to the Sandworm group, culminated in data destruction on Sept. 17, 2025.
The use of decentralized networks by state-linked hackers presents a new challenge for cybersecurity and could make it harder to attribute and disrupt cyberattacks targeting critical infrastructure like Ukraine's agricultural sector.
Russia-linked hackers utilized a decentralized, volunteer-run network to hide their communications during a cyberattack on a Ukrainian grain logistics company, according to ESET researchers. This marks the first documented instance of a state-linked group employing such a network for concealment. The attack, which began in July 2025 via a phishing email, concluded with the destruction of data on September 17, 2025. ESET attributed the operation to Sandworm, a hacking group with known ties to Russian military intelligence. The use of a decentralized network like Yggdrasil, which lacks a central server, could make such operations more difficult to track and disrupt. Researchers believe an initial access group handed control to Sandworm, though the specific malware operator remains unidentified.
Pick the topics you care about. Get only what matters, on your cadence.