Russian hackers, including the Sandworm group linked to Russia's GRU, reportedly destroyed data of a Ukrainian grain logistics company after a two-month covert presence. The attack occurred on July 16, 2025, according to ESET research. The UAC-0099 group allegedly used phishing to install malware, granting remote access.

The malware, including MythicRatatoskr, allowed attackers to execute commands, view files, and capture screenshots. A notable feature was the use of Yggdrasil, an experimental decentralized network, for command and control, making detection difficult. ESET noted this as the first documented state-linked group use of Yggdrasil in this manner.