Russian Hackers Deploy Mesh Backdoor in Ukraine Logistics Attack
Sandworm and UAC-0099 used a new mesh network backdoor in a destructive attack against a Ukrainian logistics firm. The breach began with a phishing email and led to system wiping.
TL;DR
- Sandworm collaborated with UAC-0099 in a cyberattack on a Ukrainian logistics company.
- Initial access was gained through a spear-phishing email with a malicious attachment.
- Attackers deployed a novel mesh network backdoor to maintain persistence.
- The operation resulted in destructive data wiping across targeted systems.
- ESET reported the incident, highlighting advanced tactics by Russian state-sponsored actors.
In mid-2025, a joint cyber operation by Russian state-sponsored groups Sandworm and UAC-0099 targeted a Ukrainian logistics company using sophisticated malware techniques. According to research by ESET, the attack started with a carefully crafted spear-phishing email that delivered an initial payload.
Once inside the network, attackers deployed a previously unseen mesh network backdoor, enabling them to maintain resilient command and control communications. This approach complicates detection and allows lateral movement within compromised environments. The ultimate goal appeared to be destruction, as the campaign concluded with widespread data wiping across affected systems.
Attack Vector and Initial Compromise
- The attack began on July 16, 2025, when UAC-0099 sent a spear-phishing email containing a malware-laced attachment.
- Upon execution, the attachment deployed tools that granted initial access to the victim's network.
- This method aligns with common tactics used by advanced persistent threat (APT) groups for stealthy infiltration.
Mesh Backdoor and Destructive Payload
- A new mesh network backdoor was installed to enable decentralized communication between compromised nodes.
- This backdoor made it harder for defenders to trace or disrupt command-and-control operations.
- Following the establishment of persistent access, attackers executed a destructive wiping tool across multiple systems.
- The use of such malware indicates intent to cause operational disruption rather than just espionage.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.