Sandworm Group Targets Ukrainian IT Workers with Fake Job Offers and Malicious VPN
The Sandworm-linked threat cluster UAC-0145 is using social engineering tactics, including fake job interviews, to trick Ukrainian IT professionals into installing a custom VPN that can execute arbitrary commands.
The sophisticated Russian nation-state hacking group Sandworm, operating under the guise of threat cluster UAC-0145, has launched a new social engineering campaign targeting IT professionals in Ukraine. Since at least May 2026, the group has been posing as recruiters on job search websites, reaching out to system administrators and IT specialists with seemingly legitimate job offers.
Initial contact is made through online chat platforms, but the attackers quickly shift to messaging applications like Telegram. There, they engage potential victims as HR managers for "Sopra Steria Bulgaria," a real European consulting firm, discussing general work-related topics and assessing English language proficiency. This phase is designed to build trust and prepare the victim for the next stage of the attack.
The campaign escalates with an invitation to a Zoom video conference, where the attackers present themselves as interviewers. While the identity of the person on the call is uncertain, potentially even being an AI-generated persona, the conversation continues to appear professional. Following the interview, victims receive an email with instructions for a technical assessment, which includes configuration files for connecting to a corporate VPN using WireGuard.
This VPN connection is presented as a necessary step for the assessment. However, when victims attempt to use the provided configuration, they encounter errors. At this point, the attackers direct them to download a custom VPN solution named "SopraVPN" from SourceForge, providing a link that mimics the legitimate company's website. This custom VPN is the core of the malware delivery mechanism.
The "SopraVPN" client is a modified version of the open-source WireGuard software. The attackers have introduced a "SymmetricKey" option into the configuration processing. This option contains Base64-encoded data that, when decoded, reveals AES-256-GCM encrypted commands. The attackers use a private key to decrypt these commands, which are then executed on the victim's system through WireGuard's "PostUp" command execution feature.
This allows UAC-0145 to run arbitrary PowerShell commands on compromised Windows machines without the user's knowledge. For Linux variants, the VPN client uses cURL to download secondary payloads. The specific nature of these subsequent payloads remains unclear, but the immediate goal is to establish a persistent backdoor and enable further malicious activities.
CERT-UA, the Ukrainian cybersecurity agency, is urging IT professionals to remain vigilant against such social engineering tactics. Recommendations include restricting access to corporate resources to managed devices with robust security software and enforcing continuous monitoring. This campaign highlights the evolving tactics of nation-state actors, who are increasingly leveraging sophisticated social engineering and custom malware to infiltrate critical sectors.