Sandworm Targets IT Pros With Trojanized WireGuard VPN Client

2026-08-12 09:03 UTC 3 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

System administrators and IT professionals are targeted via sophisticated social engineering campaigns involving fake job interviews.
Attackers distribute a modified WireGuard VPN client named SopraVPN hosted on SourceForge to compromise Windows and Linux hosts.
Organisations must restrict corporate resource access to managed endpoints protected by EDR solutions.

Overview of Sandworm Campaign Against IT Professionals

Sandworm hackers, tracked by the Ukrainian Computer Emergency Response Team (CERT-UA) under the cluster designation UAC-0145, have been conducting targeted social engineering campaigns against system administrators and IT professionals since at least May. According to a report by CERT-UA, the threat actors study resumes uploaded to job boards to initiate direct contact with prospective victims. Conversations are subsequently moved to Telegram to schedule video interviews conducted in English.

During these mock interviews, candidates are given technical assignments that require them to connect to a simulated corporate network. In observed instances, attackers have impersonated international IT firms such as Sopra Steria using spoofed email addresses. For technical details on how threat groups weaponize administrative utilities, security researchers often analyze how to detect trojanized VPN clients during incident response.

Technical Analysis of the Trojanized WireGuard Client

Victims are instructed via email to configure their systems to connect to a fake corporate network using WireGuard configuration files for Windows or Linux. The initial download is designed to trigger a fake error message, prompting the user to download a modified VPN client distributed via SourceForge under the name “SopraVPN”.

Key technical characteristics of the malicious binary include:

Custom Configuration Parameter: The trojanized client introduces a non-standard SymmetricKey option designed to decrypt and execute embedded PowerShell code.
Base64 Obfuscation: The standard Base64 decoding routine in WireGuard was replaced with a custom, dynamically generated alphabet. This modification conceals key strings from standard decoders and hinders static analysis.
Multi-Platform Execution: On Windows environments, the malicious command establishes a persistent scheduled task to fetch secondary payloads from external infrastructure. On Linux systems, the payload utilizes cURL to retrieve executable files via the VPN tunnel.

Mitigation Strategies and Recommendations

Defenders must address the vector of human-targeted social engineering combined with malicious tooling. Organizations should implement strict endpoint monitoring policies and enforce identity verification for recruitment processes involving technical assessments.

To mitigate risks associated with untrusted binaries, security teams should prioritize the following actions:

Restrict access to corporate resources strictly to managed, continuously monitored devices.
Deploy Endpoint Detection and Response (EDR) solutions capable of monitoring unexpected PowerShell execution and anomalous process creation spawned by VPN utilities.
Audit software installation policies to prevent employees from downloading and executing unvetted binaries from public repositories during onboarding or interview processes.

#Social Engineering

X/Twitter LinkedIn Reddit HN

← Back to Articles