Russian state-sponsored threat actors linked to Sandworm are using fake job interviews to target Ukrainian IT professionals and system administrators with a trojanized VPN client capable of running commands on victim machines.
Ukraine’s Computer Emergency Response Team, CERT-UA, attributed the activity to UAC-0145, a subgroup within Sandworm, also tracked as APT44, Seashell Blizzard, and UAC-0002. The campaign has reportedly been active since at least May 2026 and focuses on people who are likely to hold privileged access to corporate systems, networks, and remote-access infrastructure.
How the Campaign Works
The attack begins like a normal recruitment process.
The threat actors review resumes on job-search platforms and then contact potential victims while pretending to represent an IT company. Initial conversations start through job-site messaging, then move to platforms such as Telegram, where the victim speaks with a supposed HR manager.
The process is deliberately believable. Candidates are asked general work-related questions, their English skills are assessed, and they are invited to a Zoom interview with what appears to be a real person. CERT-UA noted that it is unclear whether the person on the video call was genuine or possibly AI-generated.
After that, the victim receives technical-interview instructions by email. These include WireGuard VPN configuration files for Windows or Linux, supposedly needed to connect to a corporate test environment.
When the VPN connection fails, the attackers suggest using a custom VPN application called SopraVPN, hosted through SourceForge and promoted through domains designed to mimic legitimate corporate branding.
That is where the real compromise happens.
The Trojanized VPN
The malicious VPN client is based on modified WireGuard source code.
This does not mean WireGuard itself is broken. The attackers abused the fact that WireGuard is open source and created a modified version that still appears to behave like a VPN client while hiding malicious functionality inside the application flow.
CERT-UA found that the altered client added support for a non-standard configuration option called SymmetricKey. That field contains encrypted data. The client uses the WireGuard private key from the configuration as part of the decryption process, then passes the decrypted PowerShell code into WireGuard’s normal command-execution mechanism.
In simple terms: the VPN configuration is not just a connection file.
It becomes a container for hidden code.
Once the victim runs the custom VPN client, the attacker can execute commands on the host without the victim realizing the VPN tool itself is the attack.
Windows and Linux Impact
The attack works across both Windows and Linux workflows.
On Windows, the trojanized client uses PowerShell to create a scheduled task and download a secondary payload from attacker-controlled infrastructure. On Linux, the malicious flow uses curl to retrieve another executable through infrastructure defined in the VPN configuration.
The final payload has not been fully detailed publicly, but the capability is serious enough on its own: command execution, persistence through scheduled tasks, and remote payload retrieval.
For an IT administrator or system engineer, this could give attackers a foothold on a device that has access to VPNs, credentials, SSH keys, cloud consoles, internal documentation, or production systems.
Why Fake Interviews Work
Fake recruitment attacks are effective because they exploit a trusted human process.
A job interview already creates pressure. Candidates expect to follow instructions, join meetings, complete technical tasks, download test materials, and sometimes connect to a remote lab or corporate environment.
That makes a request to install a VPN feel plausible.
This campaign is especially dangerous because it targets technical users who may normally be more cautious. The attackers are not simply sending a random attachment. They build trust through staged conversation, a live call, realistic job branding, and a technical assessment.
The result is a social engineering chain where every step looks reasonable until the victim installs the malicious client.
Why IT Workers Are High-Value Targets
UAC-0145 is not targeting random users.
System administrators and IT specialists often have access to systems that ordinary employees do not. Their devices may contain:
- VPN profiles
- SSH keys
- admin credentials
- remote-management tools
- cloud access tokens
- documentation for internal systems
- privileged browser sessions
- password-manager access
- endpoint-management consoles
Compromising one IT workstation can give an attacker a path into a much larger environment.
That is why this campaign matters beyond the individual victim. A successful fake interview can become initial access into a company, telecom provider, government contractor, or critical infrastructure supplier.
Part of a Wider UAC-0145 Shift
This is not the only recent campaign attributed to UAC-0145.
CERT-UA previously reported UAC-0145 activity using ClickFix-style fake CAPTCHA pages, where victims were tricked into running PowerShell commands manually. Those campaigns delivered malware including reconnaissance scripts, loaders, and backdoors against Ukrainian targets.
The fake interview campaign shows the same broader pattern: instead of relying only on technical exploits, the group is increasingly using social engineering that makes victims execute the attack themselves.
The technique is not unique to Russia-linked actors. The Hacker News noted that fake recruitment campaigns have also been used by Chinese, Iranian, and North Korean threat groups.
What Organizations Should Do
Companies should treat recruitment-themed malware as an enterprise security issue, not only a personal risk for job seekers.
Recommended actions include:
- allow corporate systems to access internal resources only from managed and monitored devices
- block installation of unapproved VPN clients
- restrict execution of unsigned or unknown software
- monitor for new scheduled tasks created after VPN installation
- alert on suspicious PowerShell activity linked to VPN clients
- inspect unexpected WireGuard configuration files
- train IT staff not to install interview tools on primary workstations
- provide disposable lab environments for external technical assessments
- create a clear process for reporting suspicious recruiter contact
CERT-UA recommends that organizations allow access to corporate resources only from managed devices with appropriate security software, defined policies, and continuous monitoring.
What Job Seekers Should Do
For IT professionals, the safest rule is simple: do not install recruiter-provided software on your main work machine.
Be especially cautious if a recruiter:
- moves the conversation quickly to Telegram or another messenger
- asks you to install a custom VPN
- sends configuration files for a “test network”
- claims a normal VPN failed and offers an alternative client
- uses a domain that looks similar to a known company but is not exact
- pressures you to complete the task during a live call
- provides software through file-sharing sites or third-party project pages
Legitimate employers should be able to verify themselves through official company channels and provide safe, isolated ways to complete technical assessments.
Final Thoughts
The UAC-0145 campaign shows how professional and targeted modern social engineering has become.
The attackers are not relying on obvious phishing emails or crude malware attachments. They are building an entire recruitment story around the victim, complete with chat, HR screening, video calls, technical instructions, VPN configuration files, and a custom tool that appears to solve a staged connection problem.
