Ukraine's national computer emergency response team says a unit tied to Russia's Sandworm is running fake job interviews to reach the people who hold the keys to corporate networks: system administrators and IT specialists.
In an alert published on 8 August, CERT-UA attributes the activity to UAC-0145, which it describes as a subcluster of UAC-0002, the grouping better known as Sandworm, APT44 or Seashell Blizzard. According to the CERT-UA report, the operation has been running since at least May 2026.
How the fake hiring pitch works
The operators read a candidate's CV on a job search site first, then make contact in the name of an IT company, in one case an outfit calling itself ATLAS Business Group. It starts in the site's built in chat, moves to Telegram for a screening conversation with a supposed HR manager, and then to a Zoom call. That call is real: CERT-UA says a man aged between 30 and 35 actually shows up and conducts the interview in English.
The candidate is then emailed instructions for a technical interview, along with WireGuard VPN configuration files for Linux or Windows, supposedly so they can reach a corporate network and complete test tasks. The sender address, mike.weitzman[at]soprasteria-bg[.]com, mimics a regional office of the real IT services firm Sopra Steria, whose actual domains are soprasteria[.]com and soprasteria[.]bg.
Those configuration files do not work. When the connection errors out, the recruiter points the candidate at a custom client called SopraVPN, hosted on SourceForge and linked from the fake company site under a "Corporate VPN on Sourceforge" button.
A backdoor hidden in WireGuard's own features
SopraVPN is compiled from genuine WireGuard source code with a handful of additions. The config parser was taught a nonstandard "SymmetricKey" option whose value is a BASE64 blob holding an AES-256-GCM nonce, ciphertext and authentication tag. The 32 byte AES key is simply the decoded "PrivateKey" value. What comes out is PowerShell code, which the client passes to runScriptCommand, the legitimate WireGuard routine that executes the commands defined by the PostUp option when a tunnel comes up.
The attackers also rewrote how keys are decoded. "PrivateKey" and "PublicKey" use a shuffled 64 character BASE64 alphabet, ordered by a Fisher-Yates shuffle whose seed is a CRC32 sum computed over the "SymmetricKey" text and fed to Go's math/rand. Anyone pulling the binary apart without that detail sees noise.
On Windows the decrypted PowerShell creates a scheduled task and pulls a further payload from the internet. On Linux the client uses cURL to fetch an executable from the attackers' own infrastructure through the VPN tunnel itself, which is why the configuration ships with their DNS server address.
What defenders should do
CERT-UA's advice is aimed squarely at telecom providers and IT companies, and it is blunt: allow work against corporate resources only from managed devices that carry an EDR agent, have policies applied and are continuously monitored, even when the hardware belongs to the employee. The agency also asks IT professionals themselves to be alert to the social engineering methods described.
Indicators
- Domains: soprasteria-bg[.]com, soprasteriabg[.]com, atlasgroup-ua[.]com, douncloud[.]site
- Infrastructure: 139.28.36[.]23, udp://139.28.36[.]23:51820
- Staging: hxxps://sourceforge[.]net/projects/sopravpn/, hxxps://sourceforge[.]net/projects/soprabulgariavpn/
- Contacts: mike.weitzman[at]soprasteria-bg[.]com, alex.boichenkoit[at]ukr[.]net, @Sales_ManagerABG on Telegram
- Files: SopraVPN.exe (SHA-256 aeb702f65445d12605a84be6fa31545c71be0bf619b1cbedbee5800a43fc6793) and sopravpn_v7__1_.exe (SHA-256 4646ea832a61c9f7bdb11fee64ad82ae6d9856d2f3a4b36a8a4a571145be1260)
- Host: /usr/libexec/timesyncd-check on Linux, and the scheduled task \Microsoft\Windows\ApplicationData\Microsoft on Windows
Fake recruitment is a well worn route into an organization, and we have covered the mirror image of it, where criminals posed as applicants to infect recruiters. What stands out here is the target selection. Going after administrators at telecom and IT providers buys a state operator access that scales well beyond one employer, which fits Sandworm's long record of operations against Ukraine.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.