New Malware Used Decentralised Network in Cyberattack on Ukrainian Grain Company

Cybersecurity researchers have uncovered a previously undocumented backdoor used in a cyberattack against a Ukrainian grain logistics company, revealing how attackers can conceal their communications inside a decentralised network before launching destructive operations.

In a technical report published on 22 October 2026, researchers at ESET described MythicRatatoskr, a previously unknown backdoor written in Go. The malware communicated with its command-and-control server through Yggdrasil, an experimental mesh network that connects devices using encrypted IPv6 communications without relying on a single central hub.

According to ESET, the intrusion began on 16 July 2025, when the Russia-aligned group UAC-0099 gained access through a spear-phishing email containing a malicious attachment. The attackers subsequently deployed additional malware and maintained remote access. On 17 September 2025, destructive activity attributed to the Sandworm group used Microsoft's legitimate SDelete utility to erase data across affected systems.

ESET assessed with high confidence that UAC-0099 handed access to Sandworm. However, researchers could not determine which group operated MythicRatatoskr itself. They also could not confirm whether the attack disrupted the company's grain operations. The victim organisation was not publicly identified.

The case presents a significant digital forensics challenge: how do investigators trace an intrusion when command-and-control traffic passes through a decentralised network rather than conventional attacker-controlled infrastructure?

ESET's investigation examined the malware, its network configuration and its communication infrastructure. Researchers used Yggdrasil's command-line utilities to map network peers and investigate the server's connections. They also linked the intrusion to previously documented malware and examined the subsequent destructive activity.

In a comparable investigation, analysts would correlate endpoint execution records, phishing-email artefacts, persistence mechanisms, network telemetry and Active Directory Group Policy changes. Evidence showing SDelete execution would need to be connected to the accounts, processes and administrative actions that initiated it. Because SDelete is a legitimate utility, its presence alone does not establish malicious intent.

The timeline also matters. The interval between initial access and destructive activity suggests investigators must examine historical records, not just the final wiping event, to reconstruct how access was maintained and transferred.

The forensic lesson is that decentralised infrastructure complicates attribution, but does not make reconstruction impossible. Malware artefacts, endpoint logs, network behaviour and evidence of destructive actions can still provide a defensible account provided investigators distinguish observed facts from assessments about who controlled each stage.