CERT-UA Warns of UAC-0145 Fake Recruitment VPN Malware
Ukraine’s Computer Emergency Response Team, CERT-UA, has disclosed an ongoing social-engineering campaign in which the Sandworm-linked cluster UAC-0145 targets Ukrainian system administrators and IT specialists with fake job interviews. Active since May 2026, the operation uses a modified WireGuard-based VPN client, presented as “SopraVPN”, that can execute attacker-supplied commands on a victim’s host.
CERT-UA identifies UAC-0145 as a subgroup of Sandworm, also known as APT44, Seashell Blizzard and UAC-0002, a GRU-affiliated threat group. The attackers approach candidates through job-search platforms while impersonating recruiters for IT companies, including ATLAS Business Group.
Interview process used to deliver a modified VPN
Initial discussions begin in a job platform’s chat function and then move to Telegram. A purported HR manager conducts screening conversations on behalf of Sopra Steria Bulgaria, a legitimate European consulting and software company, asking routine work questions and assessing English proficiency before arranging a Zoom interview.
CERT-UA said a Zoom meeting takes place with an English-speaking man appearing to be 30 to 35 years old, although it remains unclear whether the participant is genuine or an AI-generated synthetic persona. Candidates also receive an email with instructions for a technical assessment, WireGuard configuration files and a link to a second monitored Zoom call.
When the supplied WireGuard configuration produces errors, the operators recommend a custom VPN client. The download is promoted through links designed to resemble Sopra Steria Bulgaria’s web presence and through SourceForge projects using names such as Sopra Bulgaria VPN and SopraVPN. CERT-UA said the relevant projects were not available for download at the time of reporting.
Configuration option conceals command execution
The malicious VPN application is compiled from WireGuard source code with modifications. Its configuration parser supports a non-standard SymmetricKey option containing Base64-encoded AES-256-GCM material: a nonce, ciphertext and authentication tag. A 32-byte value decoded from PrivateKey is used as the AES-256 key.
The resulting decrypted PowerShell code is passed into WireGuard’s standard runScriptCommand mechanism, which can execute commands specified through options including PostUp. In practice, CERT-UA said, the altered client enables arbitrary commands to run without the victim’s knowledge.
On Windows, the client uses PowerShell to create a scheduled task that retrieves a second-stage payload from a remote URL. The Linux version uses cURL to download an executable through the VPN from attacker-controlled infrastructure. CERT-UA has not established the nature of that next-stage payload.
The case follows ClickFix chains targeting compromised endpoints, where ClickFix chains were also highlighted as a route to compromised endpoints, and demonstrates how recruitment workflows can be turned into delivery channels for remote-access malware.
Business implication
Organizations should allow corporate-resource access only from managed devices with appropriate security software, relevant policies and continuous monitoring, as CERT-UA recommends. IT teams should independently verify recruiters, employers and VPN downloads before installing software during any hiring assessment, and treat unexpected configuration changes or endpoint command execution as a security signal.