ESET

ESET is a Slovak cybersecurity software and research company. Its researchers analyse malicious software and publish findings about threat groups and the infrastructure they use.

On 21 October 2026, ESET reported on a 2025 intrusion at a Ukrainian grain logistics company. It said UAC-0099 phished the company and apparently handed access to Sandworm, which ESET linked to the later data-wiping attack. The hand-off remains ESET's assessment rather than a directly observed transfer in the published event summary.

The intruders routed their implants through Yggdrasil, a legitimate peer-to-peer network with no central server. ESET described this as the first documented abuse of Yggdrasil by a state-aligned actor. Yggdrasil was the command-routing network in the operation, not the wiper or a threat group.