ESET: Sandworm and UAC-0099 tied to destructive wiper attack on Ukrainian logistics firm

Past-week coverage · Original source published 2026-10-23.

Researchers at ESET have attributed a destructive wiping attack on a Ukrainian logistics company to the Russian state-sponsored group Sandworm, working alongside a second threat actor tracked as UAC-0099, also known as Earth Sirrush.

According to the report, UAC-0099 obtained initial access to the target on July 16, 2025, using a spear-phishing email that carried a malware-laced attachment. The intrusion is said to have led to the deployment of a backdoor that abuses a mesh network, a technique the report describes as new.

The findings were reported by The Hacker News. The account rests on ESET's attribution, and the details of how the two groups divided the work, and what data or systems the wiper affected, are not set out in the retained material.

Why it matters

Destructive attacks that begin with a convincing email attachment remain a practical route into corporate networks. The reported use of a mesh network for command and control is notable because it can make malicious traffic harder to spot through conventional network monitoring.

Defensive steps

The source does not publish indicators of compromise or specific detection guidance. Defenders can still treat unsolicited attachments as a primary risk, restrict outbound traffic to known services, and watch for unusual peer-to-peer or relay-style connections from endpoints. Reviewing email gateway rules and endpoint telemetry for attachment-launched processes is a reasonable starting point.