Russian-Linked Hackers Used New Mesh Network Backdoor in Destructive Ukraine Attack

Russian state-sponsored hacking group Sandworm teamed with UAC-0099 (Earth Sirrush) in a destructive wiping attack on a Ukrainian logistics company last year. ESET reported that UAC-0099 gained initial access on July 16, 2025, via a spear-phishing email with a malware-laced attachment, leading to deployment of a new mesh network backdoor.