22OCT

ESET ties Sandworm to Ukraine grain wipe

2 min read

16:31UTC

ESET says a Russia-aligned espionage group phished a Ukrainian grain logistics firm in July 2025 and apparently handed the access to Sandworm, which wiped the company's data that September.

← Back to Fridge hack spoils food in seven countries Jump to analysis ↓

TechnologyAssessed

Key takeaway

ESET says a Russian espionage group handed a Ukrainian grain firm's network to Sandworm for wiping.

Slovak security firm ESET reported on 21 October that a Ukrainian grain logistics company lost its data to a wiper attack (malware that destroys data beyond recovery) in September 2025⁠¹. ESET says UAC-0099, a Russia-aligned espionage group, phished the unnamed company in July 2025. It then apparently handed its access to Sandworm, the group linked to Russia's military intelligence service (GRU) and which Western governments blame for the 2017 NotPetya wiper, which ran the destructive attack.

The intruders hid the traffic they used to steer their implants inside Yggdrasil, an encrypted peer-to-peer network with no central server to block; ESET calls it the first documented abuse of Yggdrasil by a state-aligned actor. Researcher Anton Cherepanov led the work. ESET's case sits on the GRU side of Russian operations; Star Blizzard, the Federal Security Service (FSB) unit Microsoft tied in September to phishing of targets including Ukrainian civil society, belongs to a different service. The two-month gap between the phishing and the wipe, on ESET's timeline, shows the espionage group's access sitting in place until the destructive unit used it.

Deep Analysis

In plain English

Slovak security company ESET says Russian hackers wiped the computers of a Ukrainian company that organises grain shipments, in September 2025. One Russian group tricked staff with fake emails. It then apparently passed its access to Sandworm, a group tied to Russian military intelligence, which destroyed the data. The hackers hid their control traffic inside Yggdrasil, a network with no central server, which makes it hard to block.

Deep Analysis

Root Causes

Grain exports carry a large share of Ukraine's foreign earnings, and logistics firms coordinate the rail, port and storage chain that moves them. Destroying one firm's data disrupts scheduling and contracts without touching a port.

Yggdrasil gives attackers a resilient control channel. An encrypted peer-to-peer overlay has no central server for defenders to block or seize, so blocklists aimed at known attacker infrastructure miss it.

What could happen next?

Risk
Defenders tracking UAC-0099 phishing in Ukraine now have reason to treat its footholds as possible staging for destructive attacks.
Precedent
ESET documents the first abuse of Yggdrasil by a state-aligned actor, which network defenders may need to detect or block.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: Sandworm's NotPetya wiper in 2017 also hit Ukrainian commerce, with destruction dressed as ordinary ransomware. The grain case repeats the target choice at a smaller scale: a company on the chain that earns Ukraine export revenue.

Counter-parallel: Microsoft's September attribution of Star Blizzard phishing described an FSB-linked group that collects intelligence through patient lures. UAC-0099's role here looks similar, but its access ended in destruction, a step Microsoft did not report in Star Blizzard's campaigns.

A grain logistics firm holds scheduling, contract and customs records. Losing them can delay shipments and expose the firm to contractual penalties, though ESET did not report the commercial loss.

Consensus view: ESET, in work led by Anton Cherepanov, describes a handoff: UAC-0099 phished the grain logistics company in July 2025 and apparently passed its access to Sandworm, which ran the wiper in September. That division of labour separates the espionage foothold from the destructive operator.

Counter-view: ESET could not determine which group operated its newly found MythicRatatoskr backdoor, so the handoff rests partly on inference. ESET also notes that direct attacks on agricultural businesses have been relatively uncommon, which makes one case thin evidence of a campaign against Ukraine's grain trade.

Key tension: Whether Russian services now pass footholds between units as routine, which would make every UAC-0099 phishing case a possible prelude to a wipe.

Sources:The Record

Mentions:NotPetya →Ukraine →Russia →Microsoft →ESET →UAC-0099 →Sandworm →Yggdrasil →GRU →FSB Star Blizzard →FSB →

First Reported In

Update #15 · Fridge hack spoils food in seven countries

The Record· 22 Oct 2026

Read original →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.