SopraVPN is a trojanized VPN client distributed by UAC-0145 via SourceForge. It is compiled from WireGuard source code with modifications that allow arbitrary command execution. The malware uses AES-256-GCM to decrypt embedded payloads and can download additional malware via scheduled tasks or cURL.