What happened
On 16 July 2025, Sandworm sent a spear‑phishing email with a malicious Office document to a Ukrainian logistics firm. The attachment deployed the UAC‑0099 (Earth Sirrush) backdoor, which created a peer‑to‑peer mesh network for lateral movement. The actors used this channel to execute a destructive wipe of production servers, causing a full service outage.
Why it matters for trust and compliance
- The attack illustrates why continuous monitoring of phishing controls and network traffic is essential for a defensible control‑assurance posture, providing the evidence needed for audit readiness and incident‑response validation.
- Strengthen phishing‑awareness controls and capture training completion as audit evidence.
- Implement mesh‑network traffic logging to demonstrate continuous monitoring of anomalous communications.
Who is affected
Transportation & Logistics
Recommended actions
- Run regular, measurable phishing simulation campaigns and track remediation.
- Deploy email sandboxing solutions to block malicious attachments.
- Enable network‑traffic monitoring for mesh‑network patterns and retain logs for audit.
- Update incident‑response playbooks to include evidence‑collection steps for destructive malware.