UAC-0099 hands off access to Sandworm for wiper attack on Ukrainian logistics firm using MythicRatatoskr backdoor over Yggdrasil
ESET reports that UAC-0099 (aka Earth Sirrush) gained initial access to a Ukrainian logistics company on July 16, 2025, through a spear-phishing email with a malicious attachment. The group then handed access to Sandworm, which carried out a data-wiping attack on September 17, 2025, more than two months after the initial foothold. UAC-009…