Sandworm Hackers Target Ukrainian Organizations With Data-Wiping Malware

Russia-aligned threat actor Sandworm has intensified its destructive cyber operations against Ukrainian organisations, deploying data-wiper malware to cripple critical infrastructure and weaken the nation’s economy, according to the report. The data wipers identified are ZEROLOT and Sting, described as explicitly designed to irreversibly destroy data on compromised systems.

According to ESET APT Activity Report covering Q2 2025 through Q3 2025, the group has launched targeted attacks against governmental entities, energy companies, logistics providers, and notably, the grain sector. The wipers overwrite critical files and system data, making recovery extremely difficult without comprehensive backups, illustrating a sharp shift from espionage to immediate, catastrophic damage.

Sandworm’s operations are presented as part of a broader pattern of Russia-aligned threat actors focusing on Ukraine and related markets, with the aim of disrupting economic stability and operational resilience.