Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
CERT-UA says Sandworm-linked UAC-0145 poses as recruiters in fake job interviews to deliver a trojanized WireGuard VPN that runs attacker commands on victims' hosts.
CERT-UA attributes the campaign, ongoing since May 2026, to UAC-0145, a subgroup within GRU-affiliated Sandworm (APT44). Posing as HR staff of firms like ATLAS Business Group and Sopra Steria Bulgaria, attackers lure Ukrainian IT specialists into Zoom interviews, then share failing WireGuard configs and push a custom SopraVPN client from SourceForge. The modified WireGuard build supports a non-standard SymmetricKey option holding AES-256-GCM-encrypted PowerShell, decrypted with the decoded PrivateKey and executed via runScriptCommand. A scheduled task then downloads a second-stage payload on Windows, while the Linux variant fetches it via cURL.
- Fake SopraVPN projects on SourceForge mimic Sopra Steria Bulgaria's website; downloads unavailable at publication.
- Interviewer appeared as an English-speaking man aged 30-35, possibly an AI-generated persona.
- Targets are typically system administrators and IT specialists contacted via job sites and Telegram.
- Follows a recent UAC-0145 ClickFix campaign spreading data-stealing malware in Ukraine.
- Russia joins Chinese, Iranian, and North Korean adversaries using fake recruitment campaigns.
- ATT&CK
- T1656 ImpersonationT1204.002 Malicious FileT1140 Deobfuscate/Decode Files or InformationT1053.005 Scheduled TaskT1105 Ingress Tool Transfer
- Malware
- SopraVPN
- Organizations
- CERT-UAGRUATLAS Business GroupSopra Steria Bulgaria
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Aug 11, 2026 Social Engineering / Malware The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.