Actor Profile

Sandworm is a Russian state-sponsored APT group known for destructive cyber operations, particularly against Ukrainian critical infrastructure. In this operation, Sandworm collaborated with UAC-0099 (aka Earth Sirrush), another Russia-aligned threat actor. UAC-0099 specializes in initial access operations and has been observed transferring validated targets to Sandworm for post-exploitation and destructive attacks. This collaboration model allows UAC-0099 to focus on reconnaissance and initial compromise while Sandworm executes high-impact destructive operations. The partnership reflects a broader pattern of coordinated activity among Russia-aligned groups targeting Ukraine, similar to observed cooperation between Gamaredon-Turla and Gamaredon-InvisiMole operations.

TTPs (Tactics, Techniques, Procedures)

Initial access via spear-phishing with malicious attachments (T1566.001). Deployment of MATCHBOIL downloader leading to MATCHWOK backdoor execution. Introduction of MythicRatatoskr, a custom backdoor communicating via Yggdrasil mesh network C2 infrastructure—the first documented state-aligned abuse of this peer-to-peer network. MythicRatatoskr capabilities include victim reconnaissance, command execution via cmd.exe (T1059.003), screenshot capture (T1113), file upload/download (T1105), directory enumeration, and reverse SOCKS5 proxy deployment (T1090) for lateral movement. The backdoor employs a 10-minute startup delay for evasion (T1497). Final stage involved data destruction (T1485) via SDelete utility deployed through Active Directory Group Policy (T1484), consistent with Sandworm's NikoWiper tactics. The attack timeline spanned from initial compromise on July 16, 2025, to wiper deployment on September 17, 2025.

Targets & Patterns

The operation targeted a Ukrainian logistics company, consistent with UAC-0099 and Sandworm's broader targeting of Ukraine's critical infrastructure and economic sectors. According to ESET's Q2-Q3 2025 APT Activity Report, this collaboration has targeted government, energy, logistics, and grain sectors in Ukraine. The focus on logistics aligns with Russia's strategic interest in disrupting Ukraine's supply chains and economic resilience during ongoing conflict. The two-month dwell time between initial access and destructive action suggests thorough reconnaissance and target validation before handoff to Sandworm for maximum operational impact. The selection of a logistics company may aim to disrupt military or civilian supply operations critical to Ukraine's wartime economy.

Historical Context

This attack exemplifies an established collaboration pattern between UAC-0099 and Sandworm documented by ESET in Q2-Q3 2025, where UAC-0099 conducts initial access operations and transfers validated targets to Sandworm for post-exploitation. This cooperation model mirrors other Russia-aligned actor partnerships, including Gamaredon-Turla joint operations deploying Kazuar backdoor via PteroGraphin, and Gamaredon's Pterodo downloader delivering InvisiMole spyware against Ukrainian and Russian targets. Sandworm has a long history of destructive attacks against Ukraine, including NotPetya (2017), attacks on Ukrainian power grid, and deployment of various wiper malware families. The use of SDelete-derived wipers connects this operation to Sandworm's NikoWiper malware. The MythicRatatoskr backdoor represents a tactical evolution, marking the first documented state-aligned abuse of Yggdrasil mesh networks for C2 infrastructure.

Defensive Recommendations

  • Monitor for spear-phishing emails with malicious attachments and implement robust email security controls including attachment sandboxing and macro blocking (T1566.001)
  • Detect unusual network connections to Yggdrasil mesh network nodes by monitoring for Yggdrasil protocol traffic patterns and connections to non-standard peer-to-peer networks
  • Alert on cmd.exe execution with suspicious parent processes and command-line arguments indicative of backdoor command execution (T1059.003), particularly with network connectivity
  • Monitor for SDelete.exe execution and unusual Group Policy modifications, especially mass file deletion operations via GPO deployment (T1484, T1485)
  • Implement detection for SOCKS5 proxy deployment on endpoints and unusual internal proxy traffic patterns (T1090), combined with behavioral analytics for 10+ minute delayed network connections post-process execution

---

# Geopolitical Context

Geopolitical Context

The July–September 2025 attack on a Ukrainian logistics company represents an evolution in Russia-aligned cyber operations against Ukrainian critical infrastructure. The collaboration between Sandworm—a unit widely attributed to Russia's GRU Main Centre for Special Technologies (GTsST, military unit 74455)—and UAC-0099 (Earth Sirrush) reflects a division-of-labor model in which initial access specialists enable follow-on destructive operations. This pattern, observed across government, energy, logistics, and grain sectors in Ukraine, is consistent with sustained Russian strategic objectives to degrade Ukrainian economic resilience and wartime logistics capacity. The two-month dwell time between initial compromise (July 16) and data destruction (September 17) suggests deliberate operational security and possible intelligence collection prior to destructive action. The use of Yggdrasil, an experimental peer-to-peer mesh network, for command-and-control infrastructure marks a notable tactical innovation, likely intended to complicate attribution and enhance operational persistence against Western-supplied defensive tools.

State Actor Alignment

Sandworm is assessed with high confidence to operate on behalf of Russian military intelligence (GRU). The group has been publicly attributed by the U.S., UK, and EU governments to destructive attacks including NotPetya (2017), Ukrainian power grid disruptions (2015–2016), and the 2018 Winter Olympics sabotage. UAC-0099's role as an initial access broker for Sandworm suggests either direct tasking by Russian intelligence services or alignment within a coordinated operational framework. Similar collaboration patterns have been documented between other Russia-aligned groups, including Gamaredon (FSB-linked) and Turla (FSB), indicating a mature ecosystem of state-directed or state-tolerated actors operating in support of Russian strategic interests in Ukraine. These actors operate with apparent impunity within Russian jurisdiction and are subject to Western sanctions regimes, including U.S. Treasury OFAC designations and EU restrictive measures targeting GRU officers and infrastructure.

Business Impacty pro region

The targeting of Ukrainian logistics infrastructure directly impacts Ukraine's ability to sustain military and civilian supply chains amid ongoing conflict with Russia. Disruption of logistics and grain sectors—previously targeted in this campaign—carries spillover effects for European energy security, food supply stability, and transatlantic support for Ukraine. The attack underscores the persistent cyber threat to NATO's eastern flank and reinforces calls within the EU and NATO for enhanced collective cyber defense mechanisms, including potential invocation of Article 5-equivalent frameworks in response to cumulative destructive cyber operations. The use of novel infrastructure such as Yggdrasil mesh networks may complicate detection and response efforts by Ukrainian and allied cybersecurity teams, necessitating updated threat intelligence sharing through platforms like the EU's CERT network and NATO's Cyber Defence Centre. The incident also highlights the risk to third-party logistics providers supporting Ukrainian reconstruction and humanitarian efforts, potentially deterring commercial engagement or increasing insurance and operational costs.

Forecast

If Russia-aligned actors continue to refine initial access brokering and handoff models, Western defenders should anticipate shorter dwell times and more operationally secure intrusions across Ukrainian critical infrastructure and possibly spillover targeting of logistics providers in Poland, Romania, and the Baltics. If Yggdrasil or similar decentralized mesh networks prove effective in evading detection, adoption by additional state-aligned and cybercriminal actors is likely, complicating network defense and attribution efforts globally. Should UAC-0099 expand operations beyond Ukraine—as suggested by the existence of Linux variants of MythicRatatoskr—targets in NATO member states providing military or logistical support to Ukraine may face elevated risk. If Western governments impose additional sanctions or conduct disruptive cyber operations against GRU infrastructure in response, temporary operational pauses or retaliatory escalation against European critical infrastructure sectors may follow. Continued collaboration among Russia-aligned groups suggests that intelligence sharing and coordinated defensive measures among Ukraine, EU member states, and Five Eyes partners will remain essential to mitigating this threat through 2026.