Destructive Russian Cyberattacks on Ukraine Expand to Grain Sector

Multiple state-sponsored Russian groups are targeting Ukrainian entities and European countries connected to Ukraine, with their destructive wipers now aiming at the grain sector, according to ESET.

The report identifies Sandworm (also known as APT44, Iridium, Seashell Blizzard, TeleBots, and Voodoo Bear, and associated with GRU) as a key actor, which in April targeted a Ukrainian university with Zerolot and Sting wipers, and in June and September deployed data-wiping malware against Ukrainian governmental, energy, logistics, and grain entities.

The grain sector-targeting appears to be an attempt to weaken Ukraine’s war economy, notes ESET, which also observed collaboration between Sandworm and the Russian threat actor UAC-0099 for initial intrusions and then transferring targets of interest. The report also highlights Gamaredon’s continued activity, sometimes working with Turla, and mentions InedibleOchotense impersonating ESET in attacks against Ukrainian entities, while RomCom exploited a WinRAR zero-day to deploy backdoors in Europe and Canada.

Overall, the analysis underscores that wipers remain a frequent tool for Russia-aligned threat actors in Ukraine, with Sandworm focusing on destruction as a motive.