UAC-0099 hands access to Sandworm: MythicRatatoskr backdoor on Yggdrasil precedes SDelete wiper attack on Ukrainian grain logistics firm
ESET documented an intrusion at a Ukrainian grain logistics company in which UAC-0099 (aka Earth Sirrush, per thehackernews.com) gained initial access on July 16, 2025 through a spearphishing email with a malicious attachment, then handed access to Sandworm. Sandworm wiped data on September 17, 2025, more than two months after the first f…