Sandworm Subgroup UAC-0145 Leverages Fake Job Interviews to Compromise IT Workers
The Computer Emergency Response Team of Ukraine (CERT-UA) has issued a warning detailing a sophisticated social engineering campaign orchestrated by Sandworm, a Russian nation-state threat actor. This campaign, attributed to a subgroup tracked by CERT-UA as UAC-0145 (also known as APT44, Seashell Blizzard, and UAC-0002), specifically targets IT specialists and system administrators within Ukraine. The attackers employ elaborate fake job interviews to trick victims into installing malicious software, ultimately enabling arbitrary command execution on their systems, according to The Hacker News. This campaign has been active since at least May 2026.
This ongoing operation by UAC-0145 highlights a concerning trend where nation-state actors are increasingly blending advanced social engineering with custom malware to breach high-value targets. The focus on IT workers provides a clear path to gaining privileged access to corporate networks, making this a significant threat to organizations’ security posture.
Technical Details of the UAC-0145 Social Engineering Campaign
The attack chain begins with attackers contacting potential victims on job search websites, posing as recruiters from IT companies such as “ATLAS Business Group.” Initial conversations occur on built-in chat platforms before shifting to messaging apps like Telegram. Here, a purported HR manager, claiming to represent a legitimate Europe-based consulting firm like “Sopra Steria Bulgaria,” conducts preliminary screenings discussing general work-related questions and English proficiency.
Victims are then invited to a Zoom videoconference. While a meeting does take place with an individual, CERT-UA notes uncertainty regarding whether this person is genuine or a synthetic persona generated using artificial intelligence (AI). Following this, additional instructions for a technical interview are sent via email, including configuration files for connecting to a “corporate VPN” using WireGuard, ostensibly for an assessment.
Crucially, when victims attempt to connect using these files, they encounter error messages. The threat actors then exploit this failure by recommending the download of a custom VPN solution called “SopraVPN.” This malicious client is hosted on SourceForge, with attackers providing a deceptive link designed to mimic Sopra Steria Bulgaria’s official website (soprasteria-bg[.]com). The Hacker News also identified a third SourceForge project, sourceforge[.]net/projects/soprasteriavpn, which falsely claims to be an “open-source corporate VPN solution.”
The “SopraVPN” client is a poisoned version compiled from the WireGuard source code with specific modifications. CERT-UA explained that support for a non-standard SymmetricKey option has been added to the configuration processing mechanism. This option contains BASE64-encoded data for AES-256-GCM, including a nonce, ciphertext, and an authentication tag. A 32-byte value derived from decoding PrivateKey is used as the AES-256 key. The decrypted PowerShell code is then passed to WireGuard’s standard runScriptCommand mechanism, specifically for executing commands specified by the PostUp option. This backdoor allows the attacker to execute arbitrary commands on the victim’s host without their knowledge.
The compromise extends to both Windows and Linux environments. The Windows VPN client incorporates a PowerShell command to create a scheduled task, downloading a secondary payload from a remote URL. The Linux variant uses cURL for a similar purpose, fetching an executable file from the attackers’ infrastructure via the VPN. The exact nature of this next-stage payload remains undisclosed.
Actionable Recommendations for Defending Against UAC-0145 Compromise
Organizations and IT professionals need to be highly vigilant against social engineering tactics, particularly those involving fake recruitment. To prevent compromise by threats like the Sandworm UAC-0145 fake job interview campaign, CERT-UA urges several key protective measures:
- Strict Access Control: Allow access to corporate resources exclusively from managed devices where appropriate security software is installed and regularly updated.
- Policy Enforcement and Monitoring: Ensure relevant security policies are configured and continuously monitored for anomalies, especially concerning new software installations or VPN connections.
- User Education: Educate employees, particularly IT staff, about the sophisticated nature of phishing and social engineering attacks, emphasizing verification processes for unsolicited job offers or software downloads.
- Software Integrity Verification: When dealing with VPN clients or other critical software, verify the integrity of installers and executables through official vendor channels, hash verification, and code signing, rather than relying on third-party links.
- Endpoint Detection and Response (EDR): Implement and maintain EDR solutions to detect modified WireGuard VPN client behavior, suspicious scheduled tasks, unusual network connections (like cURL downloading executables), and PowerShell script execution that deviates from baselines.
- Network Segmentation: Segment networks to limit the lateral movement potential of an attacker who manages to compromise an endpoint.
- SourceForge Monitoring: Monitor for and block access to suspicious SourceForge projects or other public code repositories known to be used by threat actors for hosting malicious payloads.
By prioritizing these mitigations, organizations can significantly reduce their risk exposure to sophisticated nation-state campaigns targeting their workforce. Protecting against social engineering targeting IT workers requires a multi-layered defense strategy combining technical controls with comprehensive security awareness.
Related: Sandworm Targets IT Pros With Trojanized WireGuard VPN Client, UAC-0145 ClickFix Strategy: How Sandworm Targets Ukraine with Malware