Sandworm and UAC-0099 Deployed New Mesh Network Backdoor in Destructive Ukraine Wiping Attack

A Two-Stage Operation Against Ukrainian Logistics

Russian state-sponsored threat actors combined forces for a destructive operation against a Ukrainian logistics company in 2025, according to new research from ESET. The campaign paired Sandworm, one of Russia's most notorious destructive-cyber-operations units, with a second actor tracked as UAC-0099 (also known as Earth Sirrush), and introduced a previously undocumented backdoor that abuses mesh networking to maintain persistence.

The findings, reported by The Hacker News, highlight how intrusion teams and destructive payload specialists are increasingly dividing labor — with one group securing a foothold and another delivering the wiper.

Initial Access Through Spear-Phishing

According to ESET, UAC-0099 obtained the initial foothold on July 16, 2025, using a spear-phishing email carrying a malicious attachment. The lure delivered malware that established access inside the logistics firm's environment, setting the stage for the destructive phase that followed.

UAC-0099 has an established track record in Ukrainian cyber-espionage and has previously been observed delivering malware through weaponized documents and archive files. In this operation, the group appears to have served as the access broker, while Sandworm — the unit linked to some of the most damaging attacks of the past decade, including the 2015 and 2016 Ukrainian grid outages — handled the destructive payload.

A Mesh Network Backdoor

The most technically notable element of the campaign is the new backdoor, which ESET describes as relying on a mesh network architecture for command-and-control. Rather than connecting directly to a conventional remote server, mesh-based tooling routes traffic through a decentralized web of peer nodes. This design complicates detection and blocking: defenders cannot simply sinkhole a single hard-coded domain, and traffic patterns blend into ordinary encrypted internet activity.

Mesh networking has become an attractive option for adversaries because it provides resilience against infrastructure takedowns. If one node is seized or blocked, the implant can potentially still reach operators through others. For defenders in critical sectors, that means detection must shift toward behavioral indicators — unusual peer-to-peer connections, anomalous process activity, or unexpected network topology changes — rather than static indicators of compromise alone.

The Wiper Phase

ESET attributes the destructive culmination of the attack to Sandworm. The operation fits a well-documented pattern in which Russian-linked actors use espionage tooling to map a target network, escalate privileges, and prepare the ground before deploying wiper malware designed to render systems inoperable and erase forensic evidence.

Ukrainian organizations have been the primary testing ground for this playbook since 2014, and the targeting of a logistics provider is consistent with Russia's interest in disrupting supply chains that support military and civilian infrastructure. Logistics firms are attractive because their compromise can ripple outward to partners, customers, and transportation networks.

Why the Handoff Matters

Splitting an operation between an access specialist and a destructive payload team offers practical advantages to adversaries. The initial intrusion can proceed with stealthy, low-noise espionage tools, and the wiper is only introduced once the intruders have achieved sufficient reach. It also creates attribution friction: defenders investigating the early stages may focus on UAC-0099's known tradecraft while missing the link to Sandworm until destructive activity begins.

For security teams, the case reinforces the value of tracking threat-actor relationships rather than isolated malware families. An intrusion attributed to a low-profile espionage group may be a precursor to something far more damaging.

Defensive Takeaways

• Treat phishing as a pathway, not an incident. Assume that a successful lure may precede a destructive operation and hunt for lateral movement and privilege escalation immediately.
• Monitor for mesh-style C2. Baseline egress traffic and flag peer-to-peer or decentralized connection patterns that don't match business need.
• Harden backups offline. Wiper attacks target recovery capability; immutable, offline copies remain the most reliable resilience control.
• Segment logistics and OT-adjacent networks. Supply-chain operators should limit flat internal access and enforce least privilege on administrative accounts.
• Share intelligence across vendors. Cross-lab reporting, such as ESET's linkage of UAC-0099 to Sandworm, gives defenders context that single-vendor feeds may miss.

Context and Caution

The attack is dated to 2025, and ESET's reporting provides the technical detail available so far. As with any attribution, the link between the access phase and the destructive phase rests on forensic evidence and infrastructure overlaps; organizations should apply the technical indicators regardless of attribution debates. The broader lesson is clear: state-linked actors continue to refine destructive operations against Ukraine and its partners, and the barrier between espionage and sabotage is thinner than ever.