Russian Hackers Use Mesh Network to Target Ukrainian Grain Logistics
Russia-linked hacking groups targeted a Ukrainian grain logistics company using the decentralized Yggdrasil mesh network to hide their communications.
ESET, a cybersecurity firm, identified a July 2025 cyberattack against a Ukrainian grain logistics company that marked the first documented use of the decentralized Yggdrasil mesh network by a state-linked group. The attackers used the volunteer-run network to conceal their communications during the operation.
The intrusion began with a phishing email campaign targeting Ukraine's agricultural and port sectors. ESET determined that the Russia-linked hacking group UAC-0099 performed the initial breach before handing system access to Sandworm, a group linked to Russian military intelligence.
Once they gained remote control of the infected computers, the attackers used SDelete, a legitimate Microsoft administrative utility, to permanently wipe data from the systems. While the attack resulted in significant data destruction, ESET could not confirm if grain operations were disrupted or identify the specific victim company.
