GRU-linked hackers wiped data at Ukrainian grain company after two-month intrusion, ESET reports
Russian hackers destroyed data belonging to a Ukrainian grain logistics company after remaining undetected in its computer systems for two months. To control infected devices, the attackers used previously unknown malware that communicated with a server through the decentralized Yggdrasil network. Cybersecurity researchers at ESET found that two hacking groups linked to Russian interests were…
Russian-linked hackers, affiliated with the GRU military intelligence service, carried out a two-month cyber attack against a Ukrainian grain company, ultimately destroying its data. ESET, a cybersecurity firm, discovered the intrusion and the use of a previously unknown malware called MythicRatatoskr. This malware communicated with a command-and-control server through the decentralized Yggdrasil network, which added a layer of complexity to identifying and disrupting the attackers' infrastructure.
The attack began on July 16, 2025, after UAC-0099, a group linked to the GRU, tricked an employee into opening a malicious email attachment. The attackers then installed a loader and remote-access tool on the computer, giving them access to the system. Two months later, on September 17, 2025, the hackers used the SDelete utility to wipe the company's data.
ESET attributed this part of the operation to Sandworm, a hacking group also linked to the GRU. The exact extent of the damage and the specific company affected remain undisclosed.
Written by urgent.news from The Insider's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
