Russia-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
Sandworm and UAC-0099 jointly deployed a mesh-network backdoor in a destructive wiper attack on Ukrainian logistics — a C2 innovation that could complicate detection if the tactic migrates to EU targets.
Summary written by editorial AI · Source link below
The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year.
According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of
Editorial Analysis
Framed for the CISO & Security Leaders desk
Sandworm's collaboration with UAC-0099 and deployment of a novel mesh-network backdoor signals evolving Russian state-sponsored TTPs that could pivot from Ukrainian targets to EU logistics and critical infrastructure.
Brief the board on escalating Russia-linked supply-chain and logistics targeting and validate resilience of logistics-sector partners.
Russian state hackers are evolving their persistence tools with mesh-network backdoors, raising the bar for detection and response across sectors they may target next.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Threat Intel Desk
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking1d
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot2d
- Trust Is Not What It Seems — And Fraudsters Are Counting on It3d
- AI Tools Are Generating Massive Attacks for Little Cost3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)3d