Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Deploy Malicious VPN Client

The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed a new social engineering campaign attributed to UAC-0145, a subgroup of the Russian nation-state threat actor Sandworm (also known as APT44, Seashell Blizzard, and UAC-0002). The campaign, ongoing since May 2026, targets IT workers in Ukraine by posing as recruiters on job search websites.

Attackers contact potential victims—typically system administrators or IT specialists—on behalf of IT companies such as ATLAS Business Group. Initial communications occur via online chat, then shift to Telegram, where a purported HR manager for Sopra Steria Bulgaria conducts preliminary screening. Victims are invited to a Zoom interview, which may involve a synthetic AI-generated persona. Following the interview, victims receive configuration files for a corporate VPN using WireGuard, along with a link to a second Zoom meeting for a technical assessment.

When victims attempt to connect, they encounter errors, prompting attackers to recommend a custom VPN solution named SopraVPN hosted on SourceForge. The malicious VPN client is compiled from WireGuard source code with modifications, including support for a non-standard ‘SymmetricKey’ option. This option contains BASE64-encoded data for AES-256-GCM encryption, and the decrypted PowerShell code is executed via WireGuard’s ‘runScriptCommand’ mechanism, allowing arbitrary command execution. The Windows variant also creates a scheduled task to download a secondary payload, while the Linux variant uses cURL.

CERT-UA urges IT professionals to be vigilant against social engineering and recommends allowing access to corporate resources only from managed devices with appropriate security software and continuous monitoring. This campaign follows a similar ClickFix-based attack by the same threat actor and reflects a broader trend of nation-state actors using fake recruitment lures.