Plan
active
Sandworm & UAC-0099 Deploy Mesh Network Backdoor in Ukraine Wiper Attack
- Engineer — Learn: Sandworm’s novel mesh-network backdoor technique represents a new C2 architecture worth understanding for defensive design, but no specific software to patch is identified — initial access was spear-phishing, not a software vulnerability.
- SOC/IR — Plan: Review the full ESET technical report for IOCs and TTPs tied to this new backdoor, then build or tune detections for mesh-style C2 beaconing and destructive wiper staging behaviors mapped to ATT&CK; the summary is truncated so treat this as a queue item for the ESET write-up.
- Leader — Learn: Useful campaign retrospective illustrating Sandworm’s continued evolution in destructive tooling; relevant for board-level threat-landscape awareness, particularly for organizations in logistics or critical infrastructure sectors with European operations.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.