[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-eset-finds-russia-linked-hackers-hiding-in-yggdrasil-network":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},12117,"eset-finds-russia-linked-hackers-hiding-in-yggdrasil-network","ESET Finds Russia-Linked Hackers Hiding in Yggdrasil Network","ESET says a Russia-linked group routed malware traffic through Yggdrasil in an attack on a Ukrainian grain company, a documented first for state hackers.","A hacking group tied to Russia hid its malware traffic inside Yggdrasil, a decentralised network, while attacking a Ukrainian grain company, according to security firm ESET.\n\nESET said it is the first documented case of a state-linked group using Yggdrasil this way. The finding appears in a new ESET report. The company linked the attackers to Russia, and the target was a business in Ukraine's grain sector.\n\nYggdrasil is an encrypted overlay network, a layer of connections built on top of the ordinary internet and run by its participants rather than a single company. For an attacker, the appeal is practical. Defenders often catch malware by spotting its contact with known bad servers and blocking those addresses. Traffic carried over a network with no central operator gives them fewer fixed points to flag.\n\nThe technique is not new in spirit. Criminals and state-backed groups have long sent malware communications through anonymity tools such as Tor, and defenders have adapted by watching for that traffic. ESET's report suggests Yggdrasil now belongs on the same watch list.\n\nThe target also fits a familiar picture. Ukrainian businesses and agencies have been hit repeatedly by attackers linked to Russia, and a grain company sits in a sector that matters to the country's economy. For security teams, the lesson is narrower than the geopolitics: network monitoring that only recognises well-known anonymity tools may miss a less familiar one. Whether other groups adopt Yggdrasil now that the method is public is the question worth tracking.","[\"yggdrasil\",\"eset\",\"russia\",\"ukraine\"]","2026-10-22T10:01:26.000Z","2026-10-22T10:23:34.601Z","2026-10-22T10:23:34.820Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the invented 'October 22' date (the source only says 'Thursday'), and cut the reader-facing hedging about what 'the summary available so far' covers and what 'presumably sits in the full report', since it exposes the writer's limited sourcing; also tone down the unsupported speculation that few networks run Yggdrasil and the 'pattern' claim, or support them with the source.","resolved","security",[32,33,34,35],"yggdrasil","eset","russia","ukraine",[37],{"name":38,"url":39},"The Next Web","https:\u002F\u002Fthenextweb.com\u002Fnews\u002Feset-russia-hackers-yggdrasil-ukraine-grain",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7058,"2026-10-22T11:25:00.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1037,"2026-10-22T11:43:09.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",567,"2026-10-22T10:43:13.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",554,"2026-10-22T09:15:13.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",284,"2026-10-22T12:05:31.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",278,"2026-10-22T10:46:15.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",212,"2026-10-21T22:13:50.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",141,"2026-10-22T11:56:11.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Software","software",138,"2026-10-22T04:52:10.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",122,"2026-10-21T16:00:00.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",95,"2026-10-22T09:31:41.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",85,"2026-10-21T18:39:52.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]