Sandworm Deploys Novel Mesh‑Network Backdoor in Ukraine Logistics Wipe Attack

Security researchers have traced a destructive wiping operation against a Ukrainian logistics firm to the Russian state‑backed hacking group Sandworm, which is believed to have collaborated with an unidentified threat actor. The joint effort leveraged a newly discovered mesh‑network backdoor, enabling the perpetrators to spread malicious code across the target’s internal systems without relying on traditional command‑and‑control servers.

ESET’s technical analysis identifies the initial intrusion as being carried out by the UAC‑0099 toolset, also known as Earth Sirrush. Once the backdoor was installed, the attackers were able to move laterally through the network, ultimately deploying a data‑wiping payload that rendered critical logistics applications inoperable. The incident, which unfolded in late 2023, forced the company to suspend operations and highlighted the growing sophistication of cyber‑espionage tools aimed at Ukraine’s critical infrastructure.

Sandworm, a group linked to Russia’s military intelligence (GRU), has a long history of high‑profile attacks, including the 2017 NotPetya ransomware outbreak and interference campaigns targeting energy and governmental sectors. The use of a mesh‑network backdoor marks a tactical shift, allowing the malware to maintain persistence even if individual nodes are isolated or taken offline. Analysts say this approach mirrors techniques seen in advanced persistent threat (APT) operations that prioritize resilience and stealth over rapid, noisy exploitation.

The Ukrainian government and private sector have responded by tightening network segmentation and accelerating the deployment of intrusion‑detection tools that can spot anomalous mesh‑traffic patterns. International partners, including NATO cyber‑defense units, are also reviewing the findings to assess whether similar tools have been employed elsewhere in the region. While no public attribution has been made beyond the link to Sandworm, the incident underscores the broader cyber‑warfare context that has intensified since Russia’s 2022 invasion of Ukraine.

Looking ahead, cybersecurity firms warn that the mesh‑network backdoor could be repurposed for future attacks against other critical industries, from transportation to energy. ESET recommends that organizations conduct thorough network audits, enforce strict access controls, and monitor for the specific signatures associated with UAC‑0099. As the digital battlefield evolves, the line between espionage and outright sabotage continues to blur, prompting both governments and private entities to reevaluate their defensive postures against increasingly adaptable threat actors.