The intrusion began on July 16, 2025, when UAC-0099 (also tracked as Earth Sirrush) gained initial access to the target through a spear-phishing email carrying a malicious attachment. That foothold ultimately led to the deployment of a newly observed backdoor that communicates over a mesh network, alongside destructive wiping activity.

Key points from the report:

• Sandworm worked in tandem with UAC-0099 / Earth Sirrush in the operation.
• Initial access was achieved via a spear-phishing email with a malware-laced attachment.
• The campaign combined a new mesh network backdoor with a data-wiping payload targeting the logistics sector in Ukraine.

Organizations — particularly those in logistics and critical sectors — should treat unexpected attachments from unknown senders with suspicion and maintain robust endpoint detection and backup strategies to blunt both intrusion and wiper impacts.

Source: The Hacker News

Has your organization reviewed detection coverage for mesh-network command-and-control traffic and wiper-style attacks?