A hacking group tied to Russia hid its malware traffic inside Yggdrasil, a decentralised network, while attacking a Ukrainian grain company, according to security firm ESET.
ESET said it is the first documented case of a state-linked group using Yggdrasil this way. The finding appears in a new ESET report. The company linked the attackers to Russia, and the target was a business in Ukraine's grain sector.
Yggdrasil is an encrypted overlay network, a layer of connections built on top of the ordinary internet and run by its participants rather than a single company. For an attacker, the appeal is practical. Defenders often catch malware by spotting its contact with known bad servers and blocking those addresses. Traffic carried over a network with no central operator gives them fewer fixed points to flag.
The technique is not new in spirit. Criminals and state-backed groups have long sent malware communications through anonymity tools such as Tor, and defenders have adapted by watching for that traffic. ESET's report suggests Yggdrasil now belongs on the same watch list.
The target also fits a familiar picture. Ukrainian businesses and agencies have been hit repeatedly by attackers linked to Russia, and a grain company sits in a sector that matters to the country's economy. For security teams, the lesson is narrower than the geopolitics: network monitoring that only recognises well-known anonymity tools may miss a less familiar one. Whether other groups adopt Yggdrasil now that the method is public is the question worth tracking.