The **Computer Emergency Response Team of Ukraine (CERT-UA)** has unveiled details of an ongoing social engineering campaign orchestrated by Russian nation-state threat actors. The campaign specifically targets IT professionals in Ukraine, with attackers masquerading as recruiters to induce the installation of malware. **CERT-UA** attributes this activity to **UAC-0145**, a threat cluster identified as a subgroup of **Sandworm** (also known as **APT44**, **Seashell Blizzard**, and **UAC-0002**), a highly advanced hacking group with affiliations to the **GRU**. The campaign has been active since at least May 2026.  ### The Recruitment Lure Attackers initiate contact with potential victims, typically system administrators or IT specialists, via job search websites after reviewing their resumes. They impersonate representatives of IT companies, such as **ATLAS Business Group**, as a front. Initial communications occur through built-in online chats, but the conversation quickly shifts to messaging apps like **Telegram**. Here, a preliminary chat is conducted with a supposed HR manager, claiming to handle candidate screening for **Sopra Steria Bulgaria**, a legitimate Europe-based consulting and software development firm. During these chats, general work-related questions and English language proficiency are discussed. Following this, candidates are invited to a **Zoom** video conference call. ### The Technical Interview Deception The **Zoom** meeting proceeds as scheduled, featuring an English-speaking man, aged approximately 30-35. It remains uncertain whether this individual is a genuine participant or a synthetic persona potentially generated using artificial intelligence (AI). Concurrently, additional instructions for a technical interview are sent via email. These instructions include configuration files for connecting to a corporate VPN using **WireGuard**, ostensibly to complete an assessment. A link to a second **Zoom** meeting, where the test is supposedly monitored, is also provided.  Should victims attempt to connect to the VPN using the provided configuration files, they encounter error messages. This failure prompts the threat actors to recommend downloading a custom VPN solution named **SopraVPN**, hosted on **SourceForge**. They provide a deceptive link designed to mimic **Sopra Steria Bulgaria**'s legitimate website ("soprasteria-bg[.]com"). The observed **SourceForge** projects include: * sourceforge[.]net/projects/soprabulgariavpn * sourceforge[.]net/projects/sopravpn * sourceforge[.]net/projects/soprasteriavpn (identified via cached Google Search results, claiming to be an "open-source corporate VPN solution.") None of these malicious projects are currently available for download. ### WireGuard Modification and Payload Delivery **CERT-UA** explains that the attackers' VPN client is a modified version of the **WireGuard** source code. Key modifications include the addition of a non-standard 'SymmetricKey' option to the configuration processing mechanism. This option's value contains **BASE64**-encoded data for **AES-256-GCM**, including a nonce, ciphertext, and an authentication tag. A 32-byte value derived from decoding 'PrivateKey' serves as the **AES-256** key. This cleverly designed modification allows decrypted **PowerShell** code to be passed to **WireGuard**'s standard 'runScriptCommand' mechanism, which is typically used for executing commands specified by the 'PostUp' option. In essence, this poisoned **WireGuard** client enables attackers to execute arbitrary commands on the victim's host without their knowledge. The Windows VPN client leverages a **PowerShell** command to create a scheduled task that downloads a secondary payload from a remote URL. The Linux variant uses **cURL** to download an executable file from the attackers' infrastructure via the VPN. The precise nature of this next-stage payload remains undisclosed. ### Recommendations for Defense **CERT-UA** urges IT professionals to remain vigilant against such social engineering tactics to prevent malware infections. Organizations are advised to: * Restrict access to corporate resources exclusively to managed devices with appropriate security software installed. * Ensure relevant security policies are meticulously configured and consistently enforced. * Implement continuous monitoring of network and system activity. This disclosure follows a recent attribution by **CERT-UA** of **UAC-0145** to another campaign utilizing **ClickFix** social engineering to infect Ukrainian systems with data-stealing malware. The use of fake recruitment campaigns by Russian threat actors aligns them with similar tactics observed from Chinese, Iranian, and North Korean adversaries seeking unauthorized system access.