Since at least May, the **Ukrainian Computer Emergency Response Team (CERT-UA)** has been tracking a new campaign attributed to **UAC-0145**, believed to be a sub-cluster of **Sandworm**. This group is infamous for its attacks on critical infrastructure and government entities. ### Deceptive Recruitment Tactics The attackers initiate contact with IT professionals whose resumes are publicly available on job sites. Conversations are quickly moved to **Telegram**, where video interviews are arranged via **Zoom**. During these English-language interviews, candidates are given mock technical assignments that require them to connect to a 'corporate' VPN.  In one observed instance, the threat actors impersonated the international IT firm **Sopra Steria**, using seemingly legitimate email addresses that mimicked the company's Bulgarian office. ### The Malicious VPN Client Alongside interview instructions, victims receive emails containing configuration files for connecting to a 'corporate' VPN using **WireGuard** for Windows and Linux. These files are purportedly for test tasks.  Initially, the downloaded file is configured to produce a fake error. The attackers then instruct the victim to download a modified **WireGuard**-based client, dubbed 'SopraVPN', from **SourceForge**. To enhance credibility, the **SourceForge** page even included a link to `soprasteria-bg[.]com`, a domain with no actual connection to the legitimate **Sopra Steria**. ### Advanced Evasion Techniques The trojanized client incorporates a malicious, nonstandard 'SymmetricKey' configuration option. This option decrypts and executes embedded **PowerShell** code. On Windows systems, this malicious command creates a scheduled task and downloads additional payloads from the internet. For Linux targets, it uses `cURL` to retrieve another executable from attacker-controlled infrastructure via the VPN connection. **CERT-UA** also highlighted a sophisticated evasion technique: the trojanized **WireGuard** version replaces the standard **Base64** decoding with a custom, dynamically generated **Base64** alphabet. This renders key strings unreadable with standard decoders, effectively protecting the embedded **PowerShell** code from immediate analysis. ### Recommendations for Defense **CERT-UA** advises telecommunications providers and IT companies whose staff are targeted by this campaign to implement stringent security measures. This includes restricting corporate resource access to managed, continuously monitored devices protected by **EDR (Endpoint Detection and Response)** solutions, even when employees use personal equipment.