ESET将此次黑客攻击与俄罗斯联系起来；黑客利用一个去中心化的网络来隐藏他们的恶意软件，从而成功入侵了一家乌克兰的粮食公司。
ESET linked hackers to Russia, using a decentralised network to hide their malware during an attack on a Ukrainian grain company.
这家安全公司表示，这是首次有记录显示某个与政府有关联的黑客组织以这种方式使用“Yggdrasil”网络进行攻击。
The security company says it is the first documented case of a state-linked hacking group using the Yggdrasil network in this way.
相关调查结果于周四发表在ESET的一份新报告中，不过该公司并未公开受害公司的名称。
The findings were published on Thursday in a new ESET report. The company also did not identify the victim.
攻击始于2025年7月16日，黑客发送了一封钓鱼邮件，试图诱使员工点击链接并入侵公司的系统。
The attack began on 16 July 2025, when hackers sent a phishing email designed to trick an employee into opening the door to the company’s systems.
ESET将此次入侵归咎于名为“UAC-0099”的黑客组织；该组织最早由乌克兰的网络应急响应团队CERT-UA在2023年发现。
ESET attributed the initial intrusion to a group known as UAC-0099, which Ukraine’s cyber emergency response team, CERT-UA, first identified in 2023.
黑客共安装了两款恶意软件，次日又添加了另一款名为“MythicRatatoskr”的后门程序。该后门程序使他们能够在受感染的计算机上执行命令、窃取文件并截取屏幕截图。
The attackers installed two pieces of malware. The following day, they added another, a backdoor ESET named MythicRatatoskr. It let them run commands on infected computers, steal files, and take screenshots.
两个月后（9月17日），黑客彻底清除了公司所有计算机中的数据，他们使用了名为“SDelete”的合法文件删除工具，并通过公司自身的网络系统传播了该工具。
Two months later, on 17 September, the attackers wiped data across the company’s computers. The attackers used SDelete, a legitimate tool for permanently deleting files, and distributed it through the company’s own network settings.
ESET高度怀疑“Sandworm”是实施破坏性攻击的真正幕后黑手；西方政府已将“Sandworm”与俄罗斯军事情报机构GRU联系在一起。
ESET said it is highly confident that Sandworm carried out the destructive part of the attack. Western governments have linked Sandworm to Russia’s military intelligence agency, the GRU.
ESET认为“UAC-0099”为“Sandworm”提供了入侵权限，但研究人员尚未确定究竟是哪个组织开发了“MythicRatatoskr”后门程序。
ESET believes UAC-0099 gave Sandworm access, although researchers could not determine which group operated the MythicRatatoskr backdoor.
此次攻击的独特之处在于恶意软件与攻击者的通信方式：它并未依赖传统的中央服务器，而是通过“Yggdrasil”网络进行通信——这个加密网络允许设备直接在互联网上进行数据交换。
The unusual part of the attack was how the malware communicated with its operators. Instead of relying on a conventional central server, it used Yggdrasil, an encrypted network that allows devices to communicate directly across the internet.
由于“Yggdrasil”网络没有中央控制节点，ESET表示相关当局或安全团队无法通过关闭某个服务器来中断整个网络的运行。
Because Yggdrasil has no central operator, ESET said authorities or security teams can’t shut down a single server to disrupt the network.
需要注意的是，“Yggdrasil”目前仍处于实验阶段，且无法对用户进行匿名处理；使用该网络的设备仍然可以被追踪到。
The project remains experimental, however, and does not anonymise its users. Devices using it can still be traced.
据ESET研究人员称，“据我们所知，这是Yggdrasil首次被国家支持的威胁行为者以这种方式滥用的有记录案例。”
“To our knowledge, this is the first documented case of Yggdrasil being abused in this way by a state-aligned threat actor,” ESET researchers said.
ESET研究人员Anton Cherepanov向《The Record》表示，ESET未发现MythicRatatoskr被用于其他攻击的证据。
ESET has found no evidence that MythicRatatoskr has been used in other attacks, researcher Anton Cherepanov told The Record.
乌克兰农业部门一直是俄罗斯攻击的频繁目标。在全面入侵之前，农业约占该国经济的五分之一，以及其出口的近一半。俄罗斯军队还攻击了乌克兰的港口和粮食储存设施。
Ukraine’s agricultural sector has been a frequent target of Russian attacks. Before the full-scale invasion, agriculture accounted for around a fifth of the country’s economy and nearly half of its exports. Russian forces have also attacked Ukrainian ports and grain storage facilities.
ESET此前曾将Sandworm与2025年中期针对乌克兰农业、能源和运输公司的数据擦除攻击联系起来。
ESET has previously linked Sandworm to data-wiping attacks against Ukrainian agricultural, energy and transport companies in mid-2025.
乌克兰还可以通过欧盟的紧急网络储备寻求帮助，这是一项在6月达成的安排，允许该国在大规模攻击期间获得额外的网络安全支持。
Ukraine can also seek help through the EU’s emergency cyber reserve, an arrangement agreed in June that allows the country to access additional cybersecurity support during large-scale attacks.