Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack
Summary
Russian state-sponsored hackers, specifically the Sandworm group in collaboration with UAC-0099 (Earth Sirrush), conducted a destructive wiping attack against a Ukrainian logistics company. The attack commenced on July 16, 2025, with initial access gained through a spear-phishing email containing a malicious attachment.
IFF Assessment
This article describes a destructive cyberattack by a sophisticated threat actor, which represents a direct threat to organizational security and operations.
Defender Context
This incident highlights the continued targeting of critical infrastructure in Ukraine by advanced persistent threats. Defenders should be vigilant against spear-phishing campaigns, particularly those originating from known state-sponsored actors, and ensure robust endpoint detection and response capabilities are in place to identify and neutralize destructive wiper malware.