Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

A Russian state-sponsored hacking group, Sandworm, collaborated with another threat actor to launch a destructive attack on a Ukrainian logistics company. The attack occurred last year and involved obtaining initial access to the target through a spear-phishing email with a malware-laced attachment. This led to the deployment of a backdoor, and ESET has reported on the details of the attack. The threat actor UAC-0099, also known as Earth Sirrush, was involved in gaining access to the target. The attack was carried out on July 16, 2025. A new mesh network backdoor was used in the attack.