Russian-Linked Hackers Deploy New Mesh Network Backdoor in Destructive Ukraine Attack

Cybersecurity firm ESET has detailed a destructive cyberattack attributed to Russian state-sponsored group Sandworm and threat actor UAC-0099 (Earth Sirrush). The attack targeted a Ukrainian logistics company and began on July 16, 2025, when the victim opened a spear-phishing email containing a malware-laced attachment. This initial vector led to the deployment of a previously unseen mesh network backdoor, which provides attackers with a resilient, decentralized communication channel for command and control. The use of a mesh network infrastructure represents a notable evolution in the actors' technical capabilities, potentially allowing them to maintain persistence and coordination even when traditional command-and-control channels are disrupted. The attack resulted in data wiping and operational disruption within the targeted logistics entity. ESET and CERT-UA have likely issued indicators of compromise and mitigation guidance, though specific technical details of the backdoor's implementation and the full extent of the compromise remain under investigation. The collaboration between Sandworm and UAC-0099 highlights the evolving nature of threat actor partnerships in the context of the ongoing conflict in Ukraine.