Phishing Opens Door to Ukraine Wiper Attack

How the Attack Unfolded

The operation began with a single spear-phishing email sent to a Ukrainian logistics company. The message carried a malicious attachment, and when opened, it led to the deployment of a downloader called MATCHBOIL, which in turn installed the MATCHWOK backdoor. This gave the group tracked as UAC-0099 a foothold inside the organization's network on July 16, 2025. From there, UAC-0099 also deployed the MythicRatatoskr backdoor, which used a mesh network called Yggdrasil for its command-and-control communications, making detection and tracking of the malicious traffic more difficult.

What makes this incident notable is what happened next. More than two months after gaining initial access, UAC-0099 reportedly handed off control of the compromised environment to Sandworm. Sandworm then used Active Directory Group Policy to push out the SDelete utility, carrying out a destructive data-wiping attack on September 17, 2025. The long gap between the phishing email and the final destructive act shows that initial access and damaging action are often separated by weeks or months, giving defenders a window to detect and respond if the early compromise is caught.

Why the Attachment Worked

The lure was simple: a document attached to an email, with no indication in the reporting that the sender impersonated a specific brand or executive. This simplicity is part of why such lures remain effective. Employees in logistics, operations, and similar roles routinely receive attachments as part of their daily work, which can make an unexpected file feel unremarkable rather than suspicious.

Red Flags to Watch For

• An unexpected attachment arrives by email, especially one not tied to an ongoing conversation.
• The sender's identity and the business reason for the attachment cannot be independently confirmed.
• The message frames opening the attachment as the required next step, with little other context provided.

Building Resistance

Organizations in logistics, government, energy, and agriculture, the sectors named in connection with this activity, should reinforce a few habits:

• Treat unsolicited attachments as suspicious by default and verify sender identity and business context through a separate, known channel before opening them.
• Encourage fast reporting of suspected phishing emails, since an initial compromise can sit dormant for months before escalating into a destructive event.
• Extend security awareness training beyond IT staff to operations, logistics, and field personnel, since these groups were specifically targeted in the reported activity.

Techniques referenced in this activity map to spearphishing attachment delivery (attack.mitre.org/techniques/T1566/001) and user execution of a malicious file (attack.mitre.org/techniques/T1204/002), both of which rely on an employee taking the final action of opening the file.

How did the attackers first get into the network?

UAC-0099 gained initial access on July 16, 2025, through a spear-phishing email carrying a malware-laced attachment that deployed the MATCHWOK backdoor via a downloader called MATCHBOIL.

How long was the attacker inside before causing damage?

More than two months passed between the initial phishing-based foothold on July 16, 2025, and the destructive wiping attack on September 17, 2025.

What happened after the initial access was gained?

UAC-0099 reportedly handed off access to Sandworm, which carried out a data-wiping attack using Active Directory Group Policy to deploy the SDelete utility.

Which sectors were targeted in this activity?

Government, energy, logistics, and grain sectors in Ukraine were targeted, according to the reporting referenced in the article.