Sandworm Deploys Mesh Network Backdoor in Ukraine Attack

Introduction

A coordinated cyberattack against a Ukrainian logistics company in mid-2025 has revealed a new and concerning tactic employed by Russian state-sponsored threat actors. According to findings from ESET, the operation was jointly executed by the well-known Sandworm group and another actor identified as UAC-0099, also referred to as Earth Sirrush. What makes this incident particularly alarming for IT and security professionals is the deployment of a novel mesh network backdoor, which enabled persistent access and ultimately facilitated a destructive data-wiping campaign.

Attack Vector and Initial Compromise

The attack commenced on July 16, 2025, when UAC-0099 gained initial access to the target organization through a spear-phishing email. The message contained a malicious attachment designed to deliver an unnamed malware payload upon execution. While ESET has not disclosed the specific malware variant used in the initial compromise, the method aligns with established tactics commonly leveraged by both Sandworm and UAC-0099 in prior campaigns. Once inside the network, the attackers moved laterally and established a foothold that would support deeper infiltration.

Malware and Mesh Network Infrastructure

A key feature of this operation was the use of a previously undocumented mesh network backdoor. Unlike traditional command-and-control architectures that rely on centralized servers, mesh networks distribute communication across peer-to-peer nodes. This design enhances resilience by eliminating single points of failure and making detection more difficult. The backdoor allowed the attackers to maintain long-term access, exfiltrate sensitive data, and coordinate the final destructive phase of the attack. Researchers note that the mesh-based communication model may represent an evolution in how advanced persistent threat (APT) groups manage compromised environments.

Destructive Payload and Impact

Following the establishment of persistent access, the attackers deployed a destructive payload aimed at wiping critical data from the victim’s systems. While ESET confirmed the presence of data-destruction capabilities, the exact nature and scope of the wiper malware remain undisclosed. Given Sandworm’s history with high-impact disruptive tools such as NotPetya and WhisperGate, security teams should prepare for similar threats. The logistics sector, already under strain from ongoing regional conflicts, faces heightened exposure to operations that blend espionage with sabotage.

What Defenders Should Do Now

To defend against similar threats, organizations should prioritize phishing-resistant authentication, enforce strict email filtering policies, and deploy behavioral analytics to detect lateral movement. Monitoring for unusual outbound traffic patterns—especially those indicative of peer-to-peer or mesh-style communications—can help identify compromised hosts early. Network segmentation and regular offline backups remain essential in mitigating the impact of destructive payloads. Additionally, security teams should review threat intelligence reports from ESET and other vendors for indicators of compromise related to this campaign.

Conclusion

This joint campaign by Sandworm and UAC-0099 underscores the increasing sophistication of Russian-linked cyber operations targeting critical infrastructure. As these groups continue to innovate with resilient communication frameworks and destructive payloads, defenders must adopt proactive, intelligence-driven approaches. At Grivyonx Technologies, our AI-powered DevSecOps and cloud security solutions are designed to detect and neutralize evolving threats like mesh network backdoors before they cause lasting damage.