The Record reported that ESET, a Slovak security firm, linked two Russia-linked groups to one attack on an unnamed Ukrainian grain logistics company. ESET said UAC-0099, a Russia-aligned espionage group, got in during July 2025 through a phishing email, a fake message with a harmful attachment. It installed a backdoor, a hidden way into a network, and later a new tool that can run commands, steal files and take screenshots. ESET researchers believe UAC-0099 then passed access to Sandworm, a group Western agencies link to Russian military intelligence. Sandworm wiped the company's data in September.
ESET could not say which group mainly ran the new backdoor. The Record gives no figure for lost data or length of disruption. The malware hid its contact with infected computers by using Yggdrasil, a network with no central hub. Normally, defenders can block the server that malware calls. Here, the attackers used no conventional server. ESET knows of no earlier documented case of a state-aligned group using Yggdrasil this way. It warns that such networks make attacker systems more resilient and harder to trace.
The wipe came two months after the first break-in. Earlier in 2025, ESET also saw Gamaredon and Turla hit the same Ukrainian targets. Teams that run or buy software may ask whether they would treat a spy backdoor as a wipe risk, and whether their backups would survive a wiper.