Sandworm used new mesh network backdoor in Ukraine attack

ESET reported that Sandworm, together with UAC-0099, carried out a destructive wiper attack on a Ukrainian logistics company. Initial access came on July 16, 2025, via a spear-phishing email with a malicious attachment, followed by deployment of a new mesh network backdoor.

• Attack targeted a Ukrainian logistics company in 2025
• Initial access gained on July 16, 2025 via spear-phishing
• UAC-0099 operated alongside Sandworm
• A new mesh network backdoor was deployed for communication