Sandworm targets IT pros through fake job openings and a trojanized WireGuard

Ukraine's Computer Emergency Response Team, CERT-UA, has detailed a social-engineering campaign attributed to the group UAC-0145 — believed to be a subcluster of Sandworm (APT44). Since at least May 2026, the attackers have been hunting system administrators and other IT specialists by impersonating companies and recruiters.

The interview as bait

The scheme is built around a fake hiring process. The attackers study résumés posted on job-search sites and reach out to the victim directly. They move the conversation to Telegram and then schedule a video interview on Zoom — conducted in English. During the interview, the candidate is given a test assignment that supposedly requires connecting to a “corporate” VPN.

In one case documented by CERT-UA, the criminals hid behind the name of the international IT company Sopra Steria, using addresses that resembled the mail of its Bulgarian office. Along with the instructions, the victim was sent WireGuard configuration files for Linux and Windows.

The trojanized “SopraVPN”

The file that is sent is deliberately configured to produce a connection error. The victim is then asked to download a modified client called SopraVPN from SourceForge. For added credibility, the project page carries a link to the domain soprasteria-bg[.]com, which in reality has nothing to do with the genuine company.

The trojanized client supports a nonstandard configuration option, SymmetricKey, which decrypts and runs embedded PowerShell code. On Windows, the command creates a scheduled task and pulls an additional payload from the network; on Linux, cURL is used to download an executable from the attackers' infrastructure — over the VPN itself.

To hinder analysis, the developers replaced WireGuard's standard Base64 decoding with their own, dynamically generated alphabet. As a result, the key strings are unreadable by ordinary decoders, and the malicious PowerShell stays hidden.

Recommendations

CERT-UA advises telecom operators and IT companies whose employees are being targeted to restrict access to corporate resources to managed, continuously monitored devices running EDR — including when staff use personal equipment. As a reminder, APT44 is known for attacks on critical infrastructure and government agencies both in Ukraine and beyond.

Source: Bleeping Computer