Skip to content
Welcome, thoughtbot's Giant Robots listeners!Start here
Yggdrasil
AI-generated illustration
Technology

Yggdrasil

Encrypted peer-to-peer overlay network with no central server.

As at 21 October 2026, Yggdrasil was a legitimate open-source encrypted IPv6 mesh with no central server and no claim to provide anonymity.

Last refreshed: 22 October 2026 · Appears in 1 active topic

Key Question

Can defenders block MythicRatatoskr without treating all Yggdrasil traffic as malicious?

Timeline for Yggdrasil

#15 21 Oct

Carried the intruders' implant control traffic

Cybersecurity: Threats and Defences: ESET ties Sandworm to Ukraine grain wipe
View full timeline →

Background

The Yggdrasil project provides a legitimate open-source network. It forms an end-to-end encrypted IPv6 overlay between participating devices and routes traffic across a decentralised mesh. The network has no single central server whose removal would disable the whole system.

Its developers describe Yggdrasil as experimental and do not present it as an anonymity service. Encryption protects traffic across the overlay, while the network's purpose remains general connectivity between participating devices. Public peers can provide an entry point into the mesh. Those traits let legitimate users build distributed links, but they can also be abused as a route to an unrelated command server. Such abuse does not make Yggdrasil malware or show that its operators assisted an attacker.

Common Questions
What is the Yggdrasil network?
Yggdrasil is a legitimate, experimental network that creates an end-to-end encrypted IPv6 overlay between participating devices.Source: Yggdrasil project
How did MythicRatatoskr use Yggdrasil?
ESET found that the backdoor joined Yggdrasil through public peers and used the network to reach its command-and-control server over HTTPS.Source: ESET Research
Is Yggdrasil malware?
No. Yggdrasil is an open-source networking project. MythicRatatoskr abused the legitimate network as a route to its command server.Source: ESET Research
Why is Yggdrasil hard to block?
Its mesh has no single central server, so defenders cannot disable it by seizing one host. ESET says blocking the public peer addresses used by the backdoor remains possible.Source: ESET Research
Source Material

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Updated 22 October 2026. Editorial standards.