{"id":2332,"date":"2026-08-11T19:27:38","date_gmt":"2026-08-11T19:27:38","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2332"},"modified":"2026-08-11T19:27:38","modified_gmt":"2026-08-11T19:27:38","slug":"sandworm-linked-uac-0145-uses-fake-job-interviews-to-push-vpn-that-can-run-commands","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2332","title":{"rendered":"Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Aug 11, 2026<\/span><\/span>Social Engineering \/ Malware<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware.<\/p>\n

CERT-UA pinned the activity on a threat cluster it tracks as UAC-0145<\/strong>, which is a subgroup within Sandworm (aka APT44, Seashell Blizzard, and UAC-0002), a sophisticated hacking group affiliated with the GRU. The campaign is assessed to be ongoing since May 2026.<\/p>\n

\u00abSpecifically, on job search websites, after reviewing a candidate’s resume, the attackers contact a potential victim \u2013 typically a system administrator or IT specialist \u2013 on behalf of an IT company (such as ATLAS Business Group),\u00bb CERT-UA said<\/a>. <\/p>\n

Although initial communications take place via built-in online chat, the conversation subsequently shifts to messaging apps like Telegram, where a preliminary chat takes place with a purported HR manager who claims to be in charge of the candidate screening process for Sopra Steria Bulgaria, a legitimate European-based consulting and software company.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

As part of the chat, the agency said general work-related questions and the candidates’ English language proficiency are discussed, after which they are invited to join a Zoom videoconference call.<\/p>\n

<\/p>\n

While the meeting does take place as expected with an English-speaking man who appears to be between 30 and 35 years old, it’s unclear whether the person showing up in the interview was a genuine participant or a synthetic persona generated using artificial intelligence (AI).<\/p>\n

In tandem, additional instructions for a technical interview are sent via an email. This includes configuration files for connecting to the corporate VPN using WireGuard to supposedly complete an assessment, along with a link to a second Zoom meeting during which the test is monitored.<\/p>\n

\"\"<\/a><\/div>\n

Should the victim attempt to connect to the VPN using the provided configuration files, they run into error messages, causing the threat actors to recommend downloading a custom VPN solution named SopraVPN hosted on SourceForge by sharing a bogus link designed to mimic Sopra Steria Bulgaria’s website (\u00absoprasteria-bg[.]com\u00bb) –<\/p>\n