Threat Intelligence

Two Hacking Groups Shared Access in Destructive Attack on a Ukrainian Logistics Firm

The Hacker News · 23 Oct 2026

Key Takeaway Train staff to treat unexpected email attachments with suspicion, and investigate any early compromise thoroughly, because attackers may sit quietly inside a network for weeks or months before causing damage.

Security firm ESET has detailed a destructive attack on a Ukrainian logistics company in which two threat actors worked in sequence. The group UAC-0099 (also known as Earth Sirrush) gained initial access on 16 July 2025 through a spear-phishing email with a malicious attachment. That led to the installation of a backdoor called MATCHWOK, delivered by a downloader called MATCHBOIL. The group then handed access to the Russian state-sponsored group Sandworm, which carried out a data-wiping attack on 17 September 2025.

The attack stands out for a previously undocumented backdoor, MythicRatatoskr, deployed a day after MATCHWOK ran. It talks to a command server hosted inside the Yggdrasil mesh network, and ESET says this is the first documented abuse of Yggdrasil in this way by a state-aligned actor. The backdoor can take screenshots, transfer files, run commands through cmd.exe and set up a proxy to route traffic through the compromised network. Some samples wait 10 minutes before connecting, likely to avoid detection. References in its code suggest a Linux version may also exist.

To carry out the wipe, Sandworm used the SDelete utility, pushed out through Active Directory Group Policy. ESET's researchers say the use of experimental peer-to-peer networks may signal a wider trend toward more resilient and stealthy attacker infrastructure.

Sandworm Ukraine Wiper Attack Phishing Backdoor ESET

Summarised by CISO AI from The Hacker News, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.