Security · Updated 23 Oct, 04:41 pm IST
Russian-linked Sandworm used new mesh backdoor in destructive Ukraine attack
Why it matters for readers: It highlights how state-linked groups use phishing and new malware techniques to cause destructive damage, not just spy.
- ESET attributed the operation to Sandworm working with another threat actor, targeting a Ukrainian logistics company.1
- The attack was a destructive wiping operation rather than espionage or theft.1
- Initial access was obtained on July 16, 2025 via a spear-phishing email with a malware-laced attachment.1
- The intrusion involved UAC-0099, also known as Earth Sirrush.1
- Reporting says the attackers used a new mesh network backdoor as part of the incident.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started