Product

Zoom

0 mentions in 7 days · 0 in 30 days · 2 total · first seen Aug 12, 2026 · last Aug 12, 2026

Timeline2 articles

Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands

CERT-UA says Sandworm-linked UAC-0145 poses as recruiters in fake job interviews to deliver a trojanized WireGuard VPN that runs attacker commands on victims' hosts.

CERT-UA attributes the campaign, ongoing since May 2026, to UAC-0145, a subgroup within GRU-affiliated Sandworm (APT44). Posing as HR staff of firms like ATLAS Business Group and Sopra Steria Bulgaria, attackers lure Ukrainian IT specialists into Zoom interviews, then share failing WireGuard configs and push a custom SopraVPN client from SourceForge. The modified WireGuard build supports a non-standard SymmetricKey option holding AES-256-GCM-encrypted PowerShell, decrypted with the decoded PrivateKey and executed via runScriptCommand. A scheduled task then downloads a second-stage payload on Windows, while the Linux variant fetches it via cURL.

The Hacker NewsAug 12, 13:45 UTC · Aug 12, 2026Threat actor1

Researchers found a way to hijack devices through Zoom screen sharing

Researchers used a public AI tool to find a Zoom flaw enabling device hijacking via screen sharing in under 20 prompts.

Security researchers discovered a serious vulnerability in Zoom that can be used to hijack devices through the screen-sharing feature. The flaw was reportedly found by a publicly available AI tool in fewer than 20 prompts, highlighting the role of agentic AI in vulnerability discovery. The article does not report active exploitation or assign a CVE in the provided text.

Ars Technica · SecurityAug 12, 13:37 UTC · Aug 12, 2026Vulnerability

Appears with

threat actor APT44 1 threat actor Sandworm 1 threat actor UAC-0002 1 threat actor UAC-0145 1 malware SopraVPN 1 organization ATLAS Business Group 1 organization CERT-UA 1 organization GRU 1 organization Sopra Steria Bulgaria 1 product SopraVPN 1 product Telegram 1 product WireGuard 1 vendor CERT-UA 1 vendor WireGuard 1 vendor Zoom 1 victim ATLAS Business Group 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.