The Sandworm-linked UAC-0145 campaign targeting IT professionals through fake job interviews demonstrates how sophisticated threat actors are increasingly attacking privileged employees through workflows that naturally involve trust, technical discussion and software installation. Rather than relying on an obvious phishing attachment, the attackers study résumés posted on employment websites, approach selected system administrators and IT specialists while impersonating legitimate technology companies, conduct realistic recruitment conversations and eventually invite the candidate to participate in a Zoom interview. The victim is then given what appears to be a technical assessment requiring access to a corporate VPN. When the legitimate WireGuard configuration predictably fails, the supposed recruiter provides a customized VPN client named SopraVPN that contains malicious modifications capable of executing attacker-controlled commands on the candidate’s computer. The user is therefore not being asked to perform something obviously suspicious; they are doing precisely what an experienced IT professional might reasonably expect during a technical hiring process. 

CERT-UA attributes the activity to UAC-0145, which it assesses as a sub-cluster of Sandworm, also tracked as APT44 and Seashell Blizzard and associated with Russia’s GRU. The campaign has reportedly been operating since at least May 2026 and follows other UAC-0145 activity involving ClickFix lures and malware delivery. The targeting of system administrators is strategically important because compromising one privileged IT employee can give an attacker substantially more valuable opportunities than compromising an ordinary workstation. Administrators may possess VPN access, cloud credentials, SSH keys, privileged-management accounts, source-code access and detailed knowledge of the organization’s infrastructure, allowing a successful social-engineering attack against one person to become an enterprise-level intrusion.

The recruitment phase is carefully designed to reduce suspicion. Attackers identify candidates through job-search websites and use information contained in their résumés to make the outreach relevant to their experience. Initial discussions occur through legitimate employment platforms before moving to messaging applications such as Telegram, where a purported HR representative continues the screening process. General work-related questions and English proficiency are discussed before the victim is invited to participate in a video interview. This sequence resembles an ordinary international recruitment process and creates a relationship of trust before any malicious software is introduced.

CERT-UA observed attackers impersonating Sopra Steria Bulgaria, a legitimate technology consulting company, and using infrastructure designed to reinforce that identity. The candidate receives interview instructions through email and participates in a Zoom call with an English-speaking individual apparently in his thirties. CERT-UA notes that it could not determine whether the person was a real participant or an AI-generated synthetic persona. Regardless of how the interviewer was produced, the use of a live video interaction significantly strengthens the social-engineering operation because victims are naturally more likely to trust software instructions after communicating face-to-face with somebody who appears to represent the employer.

The technical assessment then provides the attacker with the opportunity to introduce malicious software without breaking the recruitment narrative. Candidates receive configuration files for connecting to a supposed corporate network using WireGuard so they can complete an assessment. When they attempt to connect with the provided settings, errors occur. The attacker then recommends downloading a customized corporate VPN client hosted on SourceForge through links associated with a look-alike Sopra Steria Bulgaria domain. The failure of the legitimate connection is not merely an inconvenience; it appears deliberately designed to create a believable troubleshooting situation in which downloading the attacker’s alternative client seems reasonable.

This technique is especially effective against technical employees because installing VPN software and troubleshooting network configuration are normal parts of their work. Traditional phishing awareness advice such as avoiding unexpected executables or suspicious attachments becomes much less useful when the file arrives as part of a technical task following several legitimate-looking recruitment interactions. Attackers have effectively moved malware delivery into a professional workflow where executing unfamiliar software appears to be evidence of competence rather than poor security behaviour.

The malicious SopraVPN application was built from legitimate WireGuard source code with several targeted modifications. This is an important design choice because the attacker does not need to recreate a complete VPN application or produce an obviously suspicious program. Most of the software behaves like WireGuard because most of it actually is WireGuard. The threat actor changes only the functionality required to transform configuration data into a covert command-execution channel, allowing the resulting application to retain the appearance and behaviour expected from a real VPN client.

One of the key modifications is support for a non-standard configuration field named `SymmetricKey`. The value stored in this field contains Base64-encoded information representing an AES-256-GCM nonce, ciphertext and authentication tag. The attacker then uses the 32-byte value obtained from the WireGuard `PrivateKey` field as the AES encryption key. When the malicious client loads the configuration, it decrypts the embedded content and obtains PowerShell code.

The decrypted PowerShell is passed through WireGuard’s legitimate `runScriptCommand` mechanism, functionality normally used to execute commands associated with configuration options such as `PostUp`. This is a particularly effective implementation because malicious behaviour is inserted into an existing legitimate execution pathway rather than requiring a completely separate malware loader. From an endpoint-monitoring perspective, the activity may initially appear to originate from networking software performing configuration-related tasks rather than from an obvious standalone malware process.

On Windows systems, the resulting PowerShell creates a scheduled task that provides persistence and downloads another payload from attacker-controlled infrastructure. This means the VPN application is essentially the initial loader. Once the secondary malware is deployed, the attackers no longer need the user to reopen SopraVPN or repeat the recruitment workflow. The scheduled task can maintain access independently.

The Linux version achieves a similar result using tooling expected on Unix-like systems. It uses cURL to retrieve an executable from attacker infrastructure through the established VPN connection. Cross-platform capability substantially increases the usefulness of the campaign because system administrators commonly work from both Windows and Linux environments, while developers, cloud engineers and DevOps personnel frequently maintain Linux workstations containing privileged credentials.

A compromised Linux administrator workstation may expose SSH private keys, Kubernetes configuration files, cloud authentication tokens, infrastructure-as-code repositories and credentials for production environments. The security significance of targeting administrators therefore goes far beyond stealing documents from the device itself. The endpoint can become a bridge into cloud infrastructure and operational systems that may never have been directly exposed to the internet.

CERT-UA has not publicly identified the exact second-stage payload distributed through this SopraVPN campaign. That uncertainty should be maintained in reporting rather than assigning a malware family or capability that has not been verified. However, the initial infection mechanism already provides arbitrary command execution and persistence, which gives the attackers enough capability to select and deploy different follow-on tools depending on the victim and intended objective.

The campaign reinforces the importance of monitoring application behaviour rather than trusting software according to its name or visual appearance. A VPN application normally has legitimate reasons to manipulate networking configuration, but it should not unexpectedly create scheduled tasks, download unrelated executables or launch encoded PowerShell. Endpoint detection systems can identify these behavioural relationships even when the malicious application is based on otherwise legitimate open-source code.

Parent-child process monitoring is particularly useful. A newly downloaded VPN application spawning PowerShell, `schtasks.exe`, a command shell or download utilities should receive additional scrutiny. On Linux, a networking client unexpectedly invoking cURL and writing executable files into user-controlled or temporary directories can provide a similarly valuable signal.

Application control can substantially reduce the attack surface. Corporate devices used by administrators should not allow arbitrary VPN binaries downloaded from recruitment websites, SourceForge projects or messaging links to execute with elevated privileges. Approved networking software should come through centrally managed repositories where publisher identity, signatures and hashes can be verified before deployment.

This does not mean SourceForge itself is malicious. Legitimate development platforms such as SourceForge and GitHub are attractive to attackers precisely because users and network-security systems recognize and trust them. Hosting location should therefore never substitute for software provenance. Anybody can upload a file to many public development services; that fact provides no guarantee that the binary corresponds to the legitimate upstream project.

The WireGuard project itself is not compromised in this campaign. The attacker compiled a deliberately modified version of its open-source client. This distinction is essential because abandoning legitimate WireGuard deployments would not address the threat. The problem is accepting an untrusted build of otherwise legitimate software supplied through a deceptive recruitment process.

Organizations should therefore educate technical employees to distinguish between an open-source project and a binary claiming to be derived from that project. When a recruiter or external organization requires a custom client, employees should independently verify the software through the legitimate company rather than trusting a download link supplied within the same conversation.

Code signing can provide additional protection if implemented properly. VPN and networking software often requires elevated privileges and should ideally be signed by an expected publisher. An unsigned customized client or a binary signed by an unfamiliar organization should generate investigation rather than routine acceptance.

Digital signatures themselves are not infallible because attackers may steal signing certificates or obtain their own certificates under deceptive identities. Verification should therefore include the expected publisher, download location and software version rather than merely checking whether Windows displays any signature at all.

Look-alike domain monitoring provides another defensive opportunity. UAC-0145 used a domain designed to resemble Sopra Steria Bulgaria when directing victims toward the malicious VPN software. Organizations can monitor newly registered domains that closely resemble their own corporate brands and work with hosting providers and registrars to remove fraudulent recruitment infrastructure quickly.

Large employers should also publish clear recruitment guidance explaining the domains and communication platforms used during hiring and whether candidates will ever be asked to install proprietary software. This gives potential victims an independent reference when unusual instructions appear during interviews.

The campaign demonstrates why IT administrators need stronger endpoint isolation than ordinary employees. Administrators often have greater freedom to install networking tools and scripts because their work genuinely requires experimentation and troubleshooting. Attackers exploit exactly that flexibility. A system administrator with unrestricted local administrator privileges can usually execute the attacker’s technical assessment with fewer security barriers than another employee.

Privileged users should therefore use managed endpoints with continuous EDR monitoring even when they are capable of configuring their own computers securely. Technical sophistication does not prevent social engineering when the attack has been designed specifically for technically sophisticated people.

CERT-UA recommends allowing corporate resource access only from managed devices equipped with appropriate security tooling and continuous monitoring. This is one of the strongest defenses against the campaign because even if an administrator executes the malicious recruitment software on a personal computer, that endpoint should not automatically become a trusted device capable of reaching sensitive corporate infrastructure.

Device identity should complement user identity. A valid username, password and MFA factor should not automatically permit administrative access from an unknown machine. Enterprises can require privileged connections to originate from enrolled devices that satisfy security posture requirements and present cryptographic device credentials.

This becomes important because malware executing on an administrator’s endpoint may steal authenticated sessions or locally stored secrets after the user has successfully completed MFA. Strong authentication protects the login process but cannot make an already compromised workstation trustworthy.

Privileged access workstations offer an even stronger security boundary. Administrators can use one device for ordinary communication, browsing and recruitment activity and a separate hardened endpoint exclusively for production administration. Compromise of the ordinary workstation then provides substantially less direct access to critical systems.

Where separate hardware is impractical, controlled administrative jump hosts can provide partial isolation. Production systems can refuse direct management connections from ordinary employee workstations and accept them only through monitored privileged-access infrastructure.

The campaign also demonstrates why employees’ personal job searches can become part of an organization’s cyber threat model without employers intruding into legitimate personal activity. Attackers may contact employees through personal email, employment platforms or Telegram, channels completely outside corporate mail security. The organization cannot and should not attempt to supervise every private recruitment conversation, but it can design corporate access so malware obtained through those conversations cannot easily reach production resources.

Personal devices should therefore receive little or no privileged corporate access. BYOD may be acceptable for low-risk applications where strong application-level controls exist, but administrative access to cloud consoles, VPN management, network equipment and production servers should generally require managed endpoints.

Technical interviews and coding assignments should be treated like any other untrusted software source. Candidates can run unfamiliar binaries inside isolated disposable virtual machines rather than on systems containing corporate credentials or personal sensitive data. The VM should have no access to the employer’s VPN, password manager or SSH keys.

VPN-related assignments require additional care because malicious networking software can manipulate routing and potentially interact with the host differently from ordinary application code. An isolated lab device or disposable cloud environment is preferable where the technical assessment genuinely requires low-level networking functionality.

The campaign also provides a strong argument for short-lived credentials. Administrators should not carry permanent SSH keys, API tokens or cloud credentials that remain valid indefinitely on everyday workstations. If malware compromises one endpoint, the useful lifetime of any stolen secret should be limited.

SSH hardware-backed keys, cloud workload identities, short-lived tokens and just-in-time privileged access can substantially reduce the value of stealing local credential files. A compromised administrator workstation becomes far more dangerous when it contains reusable access to every server the employee has managed during the previous five years.

Secrets should not be stored in shell histories, plaintext configuration files or source repositories. DevOps teams should use dedicated secret-management systems and inject credentials only when needed. Recruitment malware searching an administrator’s home directory should encounter as little reusable authentication material as possible.

Continuous identity monitoring can also detect follow-on activity. If an employee executes a malicious VPN client and attackers later attempt to use stolen credentials, unusual VPN access, cloud logins, repository activity or SSH connections may reveal the intrusion. Security teams should correlate endpoint events with identity events instead of investigating them independently.

Administrators targeted by the campaign should receive tailored security awareness rather than generic phishing reminders. The key warning is that sophisticated threat actors are willing to invest significant time in building believable recruitment processes, including real-time conversations and technical interviews. A live Zoom call is evidence that somebody can participate in a call; it is not proof that the person represents the company they claim to represent.

The possibility that an interviewer could be AI-generated makes visual confirmation even weaker. Synthetic video and voice technologies increasingly reduce the assurance historically associated with speaking to someone face-to-face. Important software requests should therefore be independently verified through trusted company channels rather than accepted solely because they followed a convincing video meeting.

The campaign joins similar fake-recruitment operations used by North Korean, Chinese and Iranian threat actors, demonstrating that job-related social engineering has become mainstream nation-state tradecraft. Recruiting is attractive because candidates expect unfamiliar people, new domains, unusual communications and technical assignments. Security cues that would appear suspicious in an ordinary business context become normal within a hiring process.

This means organizations cannot rely on attacker behaviour remaining obviously abnormal. Sophisticated social engineering succeeds by embedding malicious actions inside legitimate processes rather than by making victims ignore obvious warnings.

The defence therefore needs to assume that some users, including highly trained technical employees, will eventually execute attacker-controlled software. Security architecture should prevent one such mistake from automatically becoming privileged enterprise access.

Network segmentation, device trust, privileged-access management, application control and EDR collectively provide this containment. Each control assumes another control may fail and limits what the attacker can accomplish next.

Incident responders who discover SopraVPN or similar artifacts should isolate the endpoint immediately and investigate beyond the original application. The malicious client can create scheduled persistence and retrieve additional payloads, so deleting the VPN program alone is insufficient.

Investigators should examine scheduled tasks, PowerShell execution, cURL activity, downloaded executables and outbound connections toward attacker infrastructure. Privileged credentials present on the affected machine should be considered potentially exposed.

Sessions should be revoked and credentials rotated from a known-clean endpoint after containment. If the victim had administrative access to cloud infrastructure, source repositories or production systems, those services should be reviewed for activity occurring after the suspected infection time.

The threshold for rebuilding compromised administrator workstations should remain low. Once an unidentified second-stage payload has executed, proving that every persistence mechanism has been removed may be considerably harder than restoring a managed device from a trusted image.

Security teams should preserve forensic evidence before rebuilding so they can determine what credentials or systems were accessed. Authentication logs and cloud activity should be correlated with the infection timeline to establish whether the incident progressed beyond the employee endpoint.

The broader strategic lesson is that attackers are increasingly targeting privileged humans as part of the supply chain. An administrator’s employment activity may occur completely outside the company, but the credentials and knowledge stored on that person’s workstation connect directly back into the organization.

IT professionals should therefore be treated as high-value identities whose endpoint security and access privileges deserve protections comparable to other critical infrastructure components.

The Sandworm campaign also demonstrates why relying solely on user education will eventually fail. The attacker may conduct several conversations, study the victim’s professional background, use a real conferencing platform, impersonate a legitimate multinational company and provide technically plausible troubleshooting steps before asking the victim to run anything.

Expecting every administrator to detect every such operation perfectly is unrealistic. Security architecture must remain effective even when the attacker successfully establishes trust.

The strongest design is one where an administrator can accidentally execute malicious recruitment software on an ordinary workstation and the attacker still cannot reach production infrastructure because the device is not trusted for privileged access, reusable secrets are unavailable and suspicious persistence is detected rapidly.

The immediate defensive message is straightforward: verify recruitment communications independently, never execute custom technical-assessment software on privileged workstations, obtain security tools only from verified sources and restrict administrative access to managed devices.

The larger lesson is more important. Trust in software should come from verified provenance and controlled distribution, not from the plausibility of the person sending the download link.

In this campaign, the victim believes the recruiter, trusts the interview, accepts the technical assignment, follows the troubleshooting instructions and finally installs a VPN client intended to provide “secure” access.

The attacker uses that same chain of trust to obtain command execution on the victim’s machine.

That inversion is exactly why social engineering remains effective even against technically skilled people: the malicious action has been made to look like the responsible professional action.

The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware. CERT-UA pinned the activity on a threat cluster it tracks as UAC-0145, which is a subgroup within Sandworm (aka APT44,

Source: Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands via The Hacker News — published 11 Aug 2026.