A Ukraine-based grain logistics company was breached through a spearphishing email carrying a malicious attachment. UAC-0099 used the access to install backdoors, then handed access to Sandworm, which later deployed a data-wiping attack. The initial email attachment is a realistic awareness-training scenario, especially for logistics organizations handling sensitive operational data.
The intrusion began with a simple spearphishing email sent to a Ukrainian grain logistics company. The message carried a malicious attachment that, once opened, triggered the execution chain for the MATCHWOK backdoor. Within a day, the attackers tracked as UAC-0099 deployed a previously undocumented backdoor called MythicRatatoskr, which communicated with its command-and-control server through the Yggdrasil mesh network and could upload files and capture screenshots from infected machines.
From there, the attackers expanded their foothold. Additional MythicRatatoskr samples were pushed to other systems within the organization using an OpenSSH SFTP server, showing the compromise was not contained to a single device. Approximately two months later, researchers detected data-wiping activity at the same company. Sandworm is assessed to have used Active Directory Group Policy to deploy the SDelete utility, wiping data across the environment on September 17, 2025.
The initial email relied on a pretext that appeared relevant enough for staff in logistics or operations to open the attachment without hesitation. The sender's identity could not be independently verified, yet the message pressured the recipient to open a file directly rather than pointing to a known business portal. This kind of business-relevant framing is effective because it blends into routine daily communication for coordinators, dispatchers, and supply-chain administrators.
The attackers also used legitimate-sounding Windows service names, such as ieupdate, updater.exe, and WindowsDefenderSvc.exe, to persist on compromised machines without drawing immediate attention.
Organizations handling operational data, particularly in logistics and supply-chain roles, benefit from treating every unsolicited attachment as suspicious until verified. Employees should be encouraged to report odd attachments or unexpected system prompts immediately rather than investigating them alone. Because a single opened attachment enabled a chain that eventually led to data destruction, security teams should prepare for phishing incidents as potential business-disruption events, not just email hygiene issues, and ensure monitoring can catch unusual service creation or internal file transfer activity early.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
UAC-0099 gained initial access to a Ukrainian grain logistics company on July 16, 2025 through a spearphishing email containing a malicious attachment, which led to the MATCHWOK backdoor execution chain.
The attackers deployed a previously undocumented backdoor called MythicRatatoskr, which communicated with its command-and-control server over the Yggdrasil mesh network and spread to other machines using an OpenSSH SFTP server.
Researchers assess with high confidence that UAC-0099 handed off access to Sandworm, which used Active Directory Group Policy to deploy the SDelete utility and wipe data on September 17, 2025.
Logistics coordinators, operations staff, dispatchers, supply-chain administrators, and IT or security teams at organizations handling sensitive operational data are the most relevant audience for this scenario.
A grain logistics company got an email: “Please review the attached document.” The sender looked like a business contact, but couldn't be verified. In this real case, opening the attachment installed MATCHWOK, then MythicRatatoskr, backdoors that gave access beyond that inbox. Here's the part to remember: one file opened in July led to Sandworm wiping company data in September. A routine-looking document became a business shutdown. Unexpected attachment, even about today's shipment? Before opening it, call the contact using a number you already know.
Researchers report real-world campaigns targeting European government and diplomatic organizations using diplomatic-themed Microsoft Word documents. Victims are prompted to click “Enable Content,” which runs malicious macros that install the HOOKEDGE backdoor and connect to webhook-based…
AhnLab reports that many APT attacks targeting organizations in South Korea in July 2026 started with spear‑phishing emails that delivered malicious Windows shortcut (LNK) files disguised as legitimate documents (including resumes). When opened, the LNK runs scripts that install…
ESET reports that Russia-aligned group UAC-0099 is using spearphishing emails with malicious links to deliver a downloader called MATCHBOIL. The attack relies on tricking a person into manually running a downloaded VBScript, which then fetches and installs further malware and sets up persistence…
Microsoft reported real phishing campaigns that trick users into running a legitimate MSP360 remote-management installer disguised as meeting invites, PDFs, and software updates. After MSP360 is installed, attackers use it to silently install ScreenConnect as a second remote-access path, then use…
Microsoft reports that the Russia-linked group Star Blizzard expanded from highly targeted spear-phishing to larger email campaigns aimed at Ukraine supporters globally. Lures included tax-audit/unpaid-fine notices and fake conference invitations, followed by a password-protected archive that…
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
