Sandworm and UAC-0099 Wiper Campaign: Detecting MeshAgent-Based Unauthorized Access in the Ukraine Logistics Attack

In October 2026, ESET disclosed that the Russian state-sponsored group Sandworm (also tracked as APT44, Seashell Blizzard, and part of the GRU's Unit 74455) conducted a destructive wiping attack against a Ukrainian logistics company — but with a notable twist. Initial access was not obtained by Sandworm itself. Instead, a separate threat actor, UAC-0099 (tracked by ESET as Earth Sirrush), breached the target on July 16, 2025, via a spear-phishing email carrying a malicious attachment, then handed access over to Sandworm for the destructive phase.

This attack chain matters to every defender, not just those protecting Ukrainian infrastructure, for three reasons:

1. Access-broker collaboration is now standard practice for destructive operations. The group that phishes you is not the group that wipes you. Dwell time between initial access and destruction gave defenders a detection window — but only if they were hunting for the right artifacts.
2. The attackers leveraged a mesh-networking remote access mechanism (MeshAgent/MeshCentral-style tooling) to maintain unauthorized access. Legitimate remote management tooling abused by adversaries consistently evades signature-based detection.
3. The endgame was destruction, not extortion. There is no ransom negotiation phase in a wiper attack. Recovery depends entirely on pre-attack segmentation, backups, and early detection.

Organizations in logistics, transportation, government, defense, and any sector supporting Ukrainian operations should treat this TTP set as an active, current threat. The same playbook — spear-phish, implant, mesh-based persistent access, handoff, wiper — is directly reusable against Western logistics and critical infrastructure targets.

Technical Analysis

Threat Actors and Roles

This division of labor mirrors a broader trend ESET and CERT-UA have documented throughout 2025–2026: Russian-aligned access specialists compromising targets and passing footholds to destructive operators. Defenders should therefore treat any UAC-0099-style intrusion as a potential precursor to a Sandworm wiper deployment — not as a contained incident.

Attack Chain (Defender's View)

1. Initial Access (T1566.001): Spear-phishing email with a malicious attachment. Execution of the attachment triggered a payload chain, ultimately deploying a backdoor.
2. Persistence & Unauthorized Remote Access: The actors deployed a mesh-networking remote access agent (MeshAgent, the agent component of the open-source MeshCentral RMM platform). MeshAgent installs as a Windows service (Mesh Agent), maintains an outbound WebSocket-based C2 channel, and gives operators full interactive desktop, terminal, and file-transfer capability. Because MeshCentral is legitimate software, it frequently bypasses application control and AV allowlists.
3. Command and Control (T1102 / T1219): Outbound TLS connections to attacker-operated or self-hosted MeshCentral relay servers. Mesh-agent traffic is characterized by persistent outbound connections over TCP 443 with WebSocket upgrade headers.
4. Handoff & Staging: UAC-0099 access was leveraged by Sandworm operators, who conducted reconnaissance, credential access, and staging across the victim network.
5. Impact (T1485 / T1561.001): Deployment of wiper malware designed to overwrite or destroy data on targeted systems — consistent with Sandworm's historical wiper family (CaddyWiper, ZeroWipe, and successor tooling used against Ukrainian targets in 2025).

Exploitation Status

• Confirmed active, in-the-wild destructive use against a Ukrainian logistics organization.
• No CVE is associated with this campaign — the intrusion relied on social engineering and abuse of legitimate software, not a software vulnerability. This is precisely why patch-centric defenses are insufficient here.
• Sandworm remains one of the most aggressive state actors tracked in CISA and CERT-UA reporting; wiper deployment against logistics targets is an ongoing pattern, not a one-off event.

Why MeshAgent Is the Key Detection Anchor

When a threat actor has no exploitable vulnerability to leverage, they must leave behavioral evidence. In this campaign, the most durable, high-fidelity detection anchor is the unauthorized RMM agent itself. MeshAgent on an endpoint that your IT team did not deploy is, effectively, an intruder presence indicator. Treat any unexpected RMM tool (MeshCentral, ScreenConnect, AnyDesk, Atera, etc.) as a compromise indicator until proven otherwise.

Detection & Response

The following detections target: (1) MeshAgent installation/execution, (2) wiper precursor behavior such as shadow copy deletion, and (3) Office-to-script-interpreter execution consistent with malicious attachments. All are tuned to be high-fidelity in environments where MeshCentral is not an approved tool — if your organization legitimately uses MeshCentral, scope these rules to unauthorized server endpoints and exclude your known relay FQDNs.

---
title: Unauthorized MeshCentral MeshAgent Installation or Execution
id: 8f3d2c41-7a1e-4b9f-9c2d-5e6f7a8b9c0d
status: experimental
description: Detects installation or execution of MeshCentral MeshAgent, a legitimate RMM agent abused by Sandworm/UAC-0099 for unauthorized remote access in the Ukraine logistics wiper campaign.
references:
  - https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.command_and_control
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
      - '\meshagent.exe'
      - '\MeshAgent64.exe'
  selection_cli:
    CommandLine|contains:
      - 'meshagent'
      - 'meshcentral'
  condition: 1 of selection_*
falsepositives:
  - Environments where MeshCentral is an approved RMM platform — scope to unauthorized hosts only
level: high
---
title: Wiper Precursor - Shadow Copy and Boot Recovery Destruction
id: 2b7e9a14-3c5d-4f8a-b1e2-9d0c1a2b3c4d
status: experimental
description: Detects deletion of volume shadow copies or disabling of boot recovery, a standard precursor to Sandworm wiper and ransomware-style destructive operations.
references:
  - https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html
  - https://attack.mitre.org/techniques/T1490/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.impact
  - attack.t1490
  - attack.t1561
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'resize shadowstorage'
  selection_bcdedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains: 'shadowcopy delete'
  condition: 1 of selection_*
falsepositives:
  - Rare; legitimate backup maintenance typically uses dedicated tooling, not interactive vssadmin deletion
level: critical
---
title: Office Application Spawning Script Interpreter From Attachment Execution
id: 4c1d8f62-6e3a-4b7c-a5d9-1f2e3a4b5c6d
status: experimental
description: Detects Microsoft Office processes spawning script interpreters or LOLBins, consistent with malicious spear-phishing attachment execution used by UAC-0099 for initial access.
references:
  - https://thehackernews.com/2026/10/russian-linked-hackers-used-new-mesh.html
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\winword.exe'
      - '\excel.exe'
      - '\powerpnt.exe'
      - '\outlook.exe'
      - '\mspub.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\cmd.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: all of selection_*
falsepositives:
  - Legacy line-of-business macros — tune by baseline before enabling at high level
level: high

KQL — Microsoft Sentinel / Defender XDR Hunt

This query hunts across three stages of the campaign: unauthorized MeshAgent presence, wiper precursor commands, and Office-spawned script execution. Run each section independently or as a combined hunt over a 30-day lookback to catch pre-wiper dwell time.

// Stage 1: Unauthorized MeshAgent execution or service install
let MeshProc = DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "meshagent.exe"
   or ProcessCommandLine has_any ("meshagent", "meshcentral")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, FolderPath, InitiatingProcessFileName;
MeshProc
// Stage 2: Wiper precursor - shadow copy / recovery destruction
; DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine has "delete shadows")
   or (FileName =~ "bcdedit.exe" and ProcessCommandLine has_any ("recoveryenabled no", "bootstatuspolicy"))
   or (FileName =~ "wmic.exe" and ProcessCommandLine has "shadowcopy delete")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
// Stage 3: Office spawning script interpreters (malicious attachment execution)
; DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where InitiatingProcessFileName in~ ("winword.exe","excel.exe","powerpnt.exe","outlook.exe")
| where FileName in~ ("powershell.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","cmd.exe")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine

Velociraptor VQL — Endpoint Forensic Hunt

Use this artifact for fleet-wide sweeps to identify MeshAgent binaries, live processes, and outbound WebSocket-style connections characteristic of an unauthorized RMM foothold.

-- Hunt: Unauthorized MeshAgent presence and active C2 connections
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)meshagent|meshcentral'
   OR Exe =~ '(?i)meshagent'
   OR Name =~ '(?i)mesh'

-- Companion: enumerate MeshAgent binaries dropped on disk
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:/ProgramData/**/meshagent*.exe')

-- Companion: active outbound connections from unexpected RMM processes
SELECT Pid, Name, RemoteIP, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND Name =~ '(?i)meshagent'

Remediation & Audit Script

Run the following on suspected hosts (or deploy via your RMM/GPO fleet-wide) to audit for unauthorized MeshAgent installation, wiper precursor activity, and to re-enable recovery controls that destructive actors typically disable.

# Security Arsenal - Sandworm/UAC-0099 Unauthorized RMM & Wiper Precursor Audit
# Run elevated. Produces an audit report; -Remediate switch removes unauthorized MeshAgent.
param([switch]$Remediate)

$report = @()

# 1. Detect MeshAgent services and binaries
$svc = Get-Service -ErrorAction SilentlyContinue | Where-Object {
    $_.Name -match 'mesh' -or $_.DisplayName -match 'mesh'
}
if ($svc) { $report += "[!] Suspicious service: $($svc.Name) - $($svc.Status)" }

$bins = Get-ChildItem -Path "$env:ProgramData","C:\Program Files","C:\Program Files (x86)" `
    -Recurse -Filter "meshagent*.exe" -ErrorAction SilentlyContinue
foreach ($b in $bins) { $report += "[!] MeshAgent binary: $($b.FullName) (Created $($b.CreationTime))" }

# 2. Check shadow copy status (wipers delete these pre-impact)
$shadows = Get-WmiObject Win32_ShadowCopy -ErrorAction SilentlyContinue
$report += "[*] Volume shadow copies present: $($shadows.Count)"

# 3. Verify boot recovery settings (actors disable before wiping)
$bcd = bcdedit /enum {current} 2>$null | Out-String
if ($bcd -match 'recoveryenabled\s+No') {
    $report += "[!] Boot recovery DISABLED - possible wiper precursor"
    if ($Remediate) {
        bcdedit /set {current} recoveryenabled Yes
        $report += "[+] Re-enabled boot recovery"
    }
}

# 4. Remediate unauthorized MeshAgent if requested and no approved-use exception
if ($Remediate -and $svc) {
    Stop-Service $svc.Name -Force -ErrorAction SilentlyContinue
    sc.exe delete $svc.Name | Out-Null
    foreach ($b in $bins) { Remove-Item $b.FullName -Force -ErrorAction SilentlyContinue }
    $report += "[+] Removed MeshAgent service and binaries"
}

$report | ForEach-Object { Write-Output $_ }
$report | Out-File "$env:TEMP\mesh_wiper_audit_$(Get-Date -Format yyyyMMdd_HHmm).txt"

Remediation

There is no patch for this campaign — it exploited trust, not code. Remediation is therefore architectural and operational:

1. Eradicate unauthorized RMM tooling. Inventory every remote access tool in your environment. Maintain an approved list; treat anything off-list as an incident. Block MeshAgent, unauthorized ScreenConnect, AnyDesk, and similar agents via AppLocker or WDAC policies, and alert on service-install events (Sysmon EventID 6/7045 equivalents) matching RMM tool names.
2. Harden email against spear-phishing attachments. Enforce attachment sandboxing and detonation, block macro-enabled Office files from external senders, and deploy Mark-of-the-Web enforcement so Office child-process spawning (detected above) is denied by attack surface reduction rules. Enable ASR rule "Block all Office applications from creating child processes."
3. Protect recovery mechanisms. Restrict vssadmin, bcdedit, wbadmin, and wmic execution to a dedicated admin tier via AppLocker. Enable tamper protection and immutable/offline backups with a tested restore path — in a wiper scenario, backup integrity is your incident response plan.
4. Segment for blast-radius containment. Sandworm's wiper operations succeed at scale because of flat networks. Enforce SMB/RPC restrictions between workstation VLANs, require LAPS-managed local admin passwords, and isolate logistics/OT-adjacent systems from general corporate infrastructure.
5. Assume access-broker dwell time. If you detect an intrusion resembling UAC-0099 initial-access tradecraft, do not close the ticket at malware removal. Conduct a full hunt for secondary persistence, credential theft (LSASS access, NTDS.dit staging), and unauthorized RMM — the handoff to a destructive operator may already have occurred.
6. Monitor egress for WebSocket-style C2. MeshAgent maintains persistent outbound TLS/WebSocket sessions. Alert on long-lived outbound connections from servers and workstations to rare or recently-registered domains, and block direct workstation egress where feasible.
7. Track intelligence. Monitor ESET Threat Reports, CERT-UA advisories, and CISA advisories for Sandworm (APT44) and UAC-0099 indicator updates. Ukraine-targeting TTPs consistently migrate to Western targets within 6–18 months.

The Bottom Line

The Sandworm/UAC-0099 collaboration demonstrates that destructive operations are now a two-stage supply chain: one actor breaches, another burns it down. Your detection strategy must cover the full chain — the phishing attachment, the quiet mesh-agent persistence, and the loud wiper precursor behavior. Organizations that only hunt for the final payload will find it exactly once: when it's too late to matter.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub