[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNqOE6jKf0n_yl5xnibZQ5sQAFnSCNTs5TJ7ORxfCqK4":3},{"article":4,"iocs":56,"watch_terms":68,"solutions":69,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"11d4e427-6928-41ae-9e81-2472b43fd5b0","Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack","russian-linked-hackers-used-new-mesh-network-backdoor-in-destructive-ukraine-att-76da60","The Russian state-sponsored hacking group Sandworm teamed up with another threat actor to carry out a destructive wiping attack targeting a Ukrainian logistics company last year. According to ESET, the attack involved UAC-0099 (aka Earth Sirrush) obtaining initial access to the target on July 16, 2025, via a spear-phishing email bearing a malware-laced attachment that led to the deployment of","Russian state-sponsored threat actors Sandworm and UAC-0099 (Earth Sirrush) collaborated on a destructive wiping attack against a Ukrainian logistics company. UAC-0099 gained initial access via spear-phishing, deploying the MATCHWOK backdoor and the novel MythicRatatoskr backdoor which utilized the Yggdrasil mesh network for C2 communication. Sandworm later executed a data-wiping attack using the SDelete utility.","Sandworm and UAC-0099 used a new mesh network backdoor in a destructive Ukraine attack.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Frussian-linked-hackers-used-new-mesh.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjxH9YdfH7FHfSBJt7wrnd1P2hTQG6_2rpkp3YBqp2Yd49nYy4-a0zmvk5mqKlXH4DWfRO4Q4MmzLG4_t19me5rErcvoEpGJ5Q8LYty_GXXys63QC8HlO3G2jRC9f5vJd1BDiOp4APzxV4rSbFOZY80zIUmxvJ8V6isB-eDy9e9tVWaLR53fpPO80mzn_BH\u002Fs1600\u002Fuk-russia.jpg","2026-10-23T11:11:23+00:00","2026-10-23T12:00:12.307381+00:00",9,[17,20,22,24,27,30],{"name":18,"type":19},"Sandworm","threat_actor",{"name":21,"type":19},"UAC-0099",{"name":23,"type":19},"Earth Sirrush",{"name":25,"type":26},"ESET","vendor",{"name":28,"type":29},"Yggdrasil","technology",{"name":31,"type":32},"MythicRatatoskr","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,60,63,65],{"type":50,"value":58,"context":59},"MATCHWOK","Backdoor deployed by UAC-0099",{"type":50,"value":61,"context":62},"MATCHBOIL","Downloader used by UAC-0099",{"type":50,"value":31,"context":64},"Previously undocumented backdoor used by UAC-0099 communicating via Yggdrasil mesh network",{"type":50,"value":66,"context":67},"NikoWiper","Sandworm malware derived from SDelete",[25,31],{"controls":70,"vendors":155},[71,100,129],{"slug":72,"name":73,"problem":74,"products":75},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":101,"name":102,"problem":103,"products":104},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":130,"name":131,"problem":132,"products":133},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[134,139,147],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":135,"product_name":136,"url":137,"description":138},"defender-for-office-365","Microsoft Defender for Office 365","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-office-365","Protection for Exchange Online, Teams and SharePoint against phishing, malicious links and attachments.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png","harmony-email","Harmony Email & Collaboration","https:\u002F\u002Fwww.checkpoint.com\u002Fharmony\u002Femail-security\u002F","Email and collaboration security for Microsoft 365 and Google Workspace.",[156],{"slug":157,"name":25,"logo_path":158,"roles":159},"eset","\u002Fvendor-logos\u002Feset.png",[160],"reported_by",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":173},"sandworm-uac-0099-use-mesh-network-backdoor-in-destructive-ukraine-wiper-attack","Sandworm & UAC-0099 Use Mesh Network Backdoor in Destructive Ukraine Wiper Attack","Russian state-sponsored groups Sandworm and UAC-0099 combined spear-phishing for initial access with a novel mesh-network-based backdoor (MythicRatatoskr over Yggdrasil) to evade traditional C2 detection before executing a destructive wiper attack against a Ukrainian logistics company. The use of a decentralized peer-to-peer mesh network for command-and-control makes the malicious traffic extremely difficult to detect and block using conventional perimeter controls. The layered attack — phishing, persistent backdoors, then data destruction — demonstrates how undetected access can escalate into irreversible damage. This incident underscores that organizations, especially those in critical sectors, must combine robust email security, anomaly-based network monitoring, and tested backup and recovery capabilities to survive destructive nation-state attacks.",[166,167,168,169,170,171,172],"MITRE ATT&CK T1566: Phishing","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":174,"MITRE ATT&CK T1566: Phishing":175,"NIST SP 800-53 SI-2: Flaw Remediation":176,"CIS Control 17: Incident Response Management":177,"CIS Control 14: Security Awareness and Skills Training":178,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":179,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":180},"As a logistics company likely falling under critical or important entity status, NIS2 mandates incident handling capabilities and business continuity measures — requirements that directly address the need to detect multi-stage attacks and recover from destructive wiping events.","UAC-0099 gained initial access via spear-phishing, the exact technique this control addresses — organizations with robust email security controls and user awareness programs are far less susceptible to this initial access vector.","Robust monitoring for anomalous software and unauthorized tool execution (such as SDelete being used as a wiper) falls under maintaining system integrity, which this control mandates through continuous monitoring and rapid response to unauthorized changes.","The multi-stage nature of the attack — from initial access to backdoor deployment to eventual wiping — indicates the intrusion went undetected long enough for Sandworm to execute destructive actions, which a mature incident response capability with defined detection thresholds would have interrupted earlier.","Spear-phishing succeeded because at least one user interacted with a malicious lure; regular, targeted security awareness training helps employees recognize and report sophisticated phishing attempts before they result in compromise.","Hardening endpoints to prevent unauthorized utilities and novel backdoors from executing requires an active vulnerability and configuration management program that would have reduced the attack surface exploited during this intrusion.","Limiting the blast radius of the phishing compromise through strong access controls and least-privilege principles would have made it significantly harder for threat actors to move laterally and deploy additional backdoors across the environment."]