Security firm ESET says the Russian state-linked group Sandworm collaborated with another threat actor in a destructive cyberattack against a Ukrainian logistics company in 2025. According to the researchers, the intrusion began with a spear-phishing email carrying a malicious attachment and ultimately led to malware deployment designed to disrupt operations.

While the incident was reported in the context of the war in Ukraine, the techniques described are relevant well beyond that specific target. For European businesses, especially those in logistics, transport, supply chain operations and distributed IT environments, the case is a reminder that phishing-based access can escalate into broader network compromise and destructive impact.

What happened

According to ESET, initial access was obtained on July 16, 2025 by a threat actor tracked as UAC-0099, also known as Earth Sirrush, through a spear-phishing email with a malware-laced attachment. ESET says Sandworm then worked in combination with that access to support a destructive attack on the Ukrainian logistics company.

The report highlights the use of a new backdoor architecture described as a mesh-network approach, alongside wiping activity intended to damage systems and interrupt business operations. As reported by ESET, the operation appears to have been structured not just for espionage or quiet persistence, but for operational disruption.

The findings come from security researchers rather than a public law-enforcement announcement, so the technical assessment should be understood as an attribution and incident analysis by ESET.

Why it matters for European businesses

The immediate target was a Ukrainian company, but the broader lessons are highly relevant across Europe. Logistics businesses, manufacturers, retailers, e-commerce operators and service firms depend on interconnected systems, email workflows and third-party software access. An intrusion that starts with one employee opening a malicious attachment can spread into file servers, workstations and operational systems.

The reported use of a mesh-style backdoor is notable because it suggests an effort to maintain communication between compromised systems in a resilient way. For defenders, that can make detection and containment harder than with a single obvious command-and-control channel.

For European companies, the practical concern is not only state-sponsored targeting. Techniques first seen in geopolitical attacks often reappear in criminal operations or influence how other attackers design malware. That means businesses should pay attention even when they are not the intended geopolitical target.

The case is also relevant for resilience planning. A destructive attack against a logistics or supply-chain business can affect order fulfilment, customer communications, inventory management and partner integrations, creating immediate commercial disruption.

Who may be affected

• Logistics and transport companies with large user populations, distributed endpoints and operational dependencies.
• E-commerce businesses relying on external warehousing, shipping and fulfilment partners.
• Manufacturers and distributors whose production or delivery schedules depend on digital coordination.
• IT and security teams responsible for email security, endpoint detection, segmentation and incident response.
• Businesses operating in or near high-risk regions or supporting critical supply-chain functions linked to Eastern Europe.

What companies should consider

• Review phishing defences by tightening attachment controls, sandboxing suspicious files and reinforcing user awareness training for targeted email attacks.
• Harden endpoint monitoring so security teams can detect unusual process execution, lateral movement and persistence behaviour across multiple hosts.
• Segment networks to limit how far an attacker can move after initial access, especially between office IT, server environments and operational systems.
• Test backup and recovery plans against destructive scenarios, not only ransomware encryption, to confirm systems can be restored quickly.
• Assess third-party and supply-chain exposure where logistics partners or service providers have direct system integrations or data access.
• Prepare incident response playbooks for wipe attacks, including host isolation, credential reset procedures and communications with partners and customers.

Although this incident focused on a Ukrainian target, it underlines a broader issue for European businesses: email-borne intrusion remains a practical route into business networks, and destructive malware can turn a single compromised inbox into a much wider operational crisis.