Security· ★★★· bearish·

ESET: Russian hackers hid malware traffic in Yggdrasil network during attack on Ukrainian grain firm

  • —A phishing email on July 16, 2025 gave initial access; the intrusion was first tied to UAC-0099
  • —The MythicRatatoskr backdoor ran commands, stole files and took screenshots
  • —Yggdrasil was used as a malware C2 channel for the first time, though it does not anonymize users
  • —On September 17 data was wiped with SDelete; the destructive phase was attributed to Sandworm (GRU)
Why it matters: The first documented case of a decentralized network carrying malware C2 traffic signals that blockchain-style infrastructure can be abused in cyberattacks.
Source: DiarioBitcoin
More on this
Security · Oct 9
Netskope uncovers malware that stole about $100K in crypto
 Security · Oct 7
PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet
 Security · Oct 2
Sucuri Finds Self-Healing WordPress Malware Powered by Ethereum RPC