Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
Summary: CERT-UA attributed a social engineering campaign running since May 2026 to UAC-0145, a subgroup within Sandworm (APT44, affiliated with the GRU), in which attackers pose as recruiters on job search sites and move candidates to Telegram and Zoom interviews while posing as HR for Sopra Steria Bulgaria. Victims are sent WireGuard VPN configuration files and then a modified 'SopraVPN' client hosted on SourceForge, compiled from WireGuard source with an added 'SymmetricKey' option that decrypts PowerShell code and passes it to WireGuard's 'runScriptCommand' mechanism, allowing arbitrary command execution; the Windows client also creates a scheduled task to download a secondary payload, and the Linux variant uses cURL.
Why it matters: The lure is a working VPN config and a real-looking interview, so the malicious step arrives as a technical exercise the candidate was asked to complete - and the modified client runs commands through WireGuard's own 'PostUp' path, which most endpoint controls treat as legitimate VPN behavior.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026