After a brief lull, Russian state-sponsored hackers have renewed destructive “wiper” attacks on Ukrainian systems in 2025, marking a sharp escalation in Moscow’s ongoing hybrid warfare.
According to cybersecurity firm ESET, the Sandworm group — operated by Russia’s GRU Unit 74455 (APT44/FrozenBarents) — has resumed large-scale data-wiping operations targeting Ukraine’s government, energy, logistics, and grain sectors, aiming to weaken its wartime economy. The attacks employ new malware families such as “Sting” and “ZeroLot,” ofte
ESET reports increasing collaboration among Russian APT units, particularly between UAC-0099 and Sandworm. UAC-0099 specializes in initial access via phishing, malicious LNK/HTML files, and PowerShell scripts, before handing compromised targets to Sandworm for destructive follow-up. Its new MatchBoil loader delivers tools like the MatchWok backdoor and DragStare infostealer, capable of stealing encryption keys, browser data, and sensitive documents.
Parallel operations by Gamaredon (FSB), Turla, and RomCom (Storm-0978) have intensified, using WinRAR zero-day exploits and joint campaigns across Europe and Canada against organizations tied to Ukraine’s defense, finance, and logistics sectors.
The resurgence underscores Moscow’s dual strategy: cyber destruction and psychological disruption. Russian agencies are increasingly leveraging cybercriminal and hacktivist proxies to amplify propaganda, conduct deniable DDoS and data-leak campaigns, and sustain psychological pressure on Ukrainian institutions.
This shift from espionage back to destructive operations signals a renewed offensive phase in Russia’s cyber doctrine — one that integrates APT collaboration, hybrid warfare, and proxy cybercrime to achieve economic destabilization and geopolitical influence.
Experts warn that these joined-up Russian campaigns foreshadow more aggressive, multi-vector attacks on critical infrastructure and supply chains, extending beyond Ukraine to NATO-aligned nations.
