Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
-
The Russian state-sponsored group Sandworm collaborated with a second threat actor to conduct a destructive wiping attack against a Ukrainian logistics company last year, according to findings from ESET.
The intrusion began on July 16, 2025, when UAC-0099 (also tracked as Earth Sirrush) gained initial access to the target through a spear-phishing email carrying a malicious attachment. That foothold ultimately led to the deployment of a newly observed backdoor that communicates over a mesh network, alongside destructive wiping activity.
Key points from the report:
- Sandworm worked in tandem with UAC-0099 / Earth Sirrush in the operation.
- Initial access was achieved via a spear-phishing email with a malware-laced attachment.
- The campaign combined a new mesh network backdoor with a data-wiping payload targeting the logistics sector in Ukraine.
Organizations — particularly those in logistics and critical sectors — should treat unexpected attachments from unknown senders with suspicion and maintain robust endpoint detection and backup strategies to blunt both intrusion and wiper impacts.
Source: The Hacker News
Has your organization reviewed detection coverage for mesh-network command-and-control traffic and wiper-style attacks?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login