Ukraine’s CERT-UA has exposed a fake recruitment campaign run by Sandworm-linked threat actors that lures IT workers into installing a poisoned WireGuard VPN client capable of running arbitrary commands on their machines.
The campaign, attributed to the UAC-0145 cluster and assessed as ongoing since May 2026, starts on job search websites. After reviewing a candidate’s resume, attackers contact system administrators and IT specialists while posing as an IT company, then shift the conversation to Telegram, where a purported HR manager screens the candidate on behalf of Sopra Steria Bulgaria, a real European consulting firm.
Victims are invited to a Zoom interview that actually takes place, with an English-speaking man who may be a genuine participant or an AI-generated persona. During the process, the candidate receives configuration files for connecting to a corporate VPN using WireGuard to complete a technical assessment. When the configs fail, the attackers recommend a custom VPN client hosted on SourceForge under names that mimic the legitimate company, such as soprasteria-bg dot com.
That client is the payload. CERT-UA said it was compiled from WireGuard source with modifications that add a non-standard SymmetricKey option. The value carries BASE64-encoded AES-256-GCM data, and a 32-byte value decoded from the PrivateKey serves as the encryption key. The decrypted PowerShell code is passed to WireGuard’s runScriptCommand mechanism, letting attackers execute arbitrary commands on the victim host without their knowledge.
The Windows variant also creates a scheduled task that downloads a secondary payload from a remote URL, while the Linux version uses cURL to pull an executable from attacker infrastructure.
Ukraine’s computer emergency response team urges organizations to allow corporate access only from managed devices with security software installed, and to enforce continuous monitoring. The disclosure lands less than a month after CERT-UA tied UAC-0145 to a ClickFix campaign pushing data-stealing malware.
