UAC-0145 (Sandworm subcluster) trojanizes WireGuard VPN client "SopraVPN" in fake IT recruitment campaign impersonating Sopra Steria Bulgaria
UAC-0145 (Sandworm subcluster) trojanizes WireGuard VPN (TL-2026-1973), also tracked as SopraVPN campaign, is a high-severity malware campaign, first published 2026-08-10. It is attributed to UAC-0145 (Russia) with high confidence, affects N/A (open-source software trojanized; Sopra Steria Group impersonated, maps to 15 MITRE ATT&CK techniques (T1027.010, T1036.005, T1053.005), and is covered by 9 detection rules and 9 indicators of compromise.
Key facts for TL-2026-1973
- Threat ID
- TL-2026-1973
- Also known as
- SopraVPN campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-10
- Last reviewed
- 2026-08-10
- Attribution
- UAC-0145
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- telecoms, information technology
- Target regions
- ukraine
- Detection rules
- 9
- Indicators of compromise
- 9
Malware and tooling in UAC-0145 (Sandworm subcluster) trojanizes WireGuard VPN
Malware and tooling: SopraVPN, telegram, WireGuard
CERT-UA reports UAC-0145, a Sandworm/APT44/Seashell Blizzard subcluster (rolled up under UAC-0002), running fake IT-recruitment operations impersonating Sopra Steria Bulgaria to target system administrators and IT professionals at telecom and IT companies. Victims are lured via fake HR/Telegram screening and Zoom technical interviews into installing a trojanized WireGuard client ("SopraVPN") hosted on SourceForge whose config embeds a custom AES-256-GCM "SymmetricKey" option that decrypts and executes attacker PowerShell via WireGuard's "PostUp" hook.
How UAC-0145 (Sandworm subcluster) trojanizes WireGuard VPN works
UAC-0145 is a CERT-UA-tracked subcluster of Sandworm (APT44/Seashell Blizzard, GRU-affiliated, rolled up under the umbrella designation UAC-0002) running a targeted social-engineering campaign against Ukrainian system administrators, IT professionals, and telecom-sector staff. Operators pose as recruiters for a fictitious hiring process branded as "Sopra Steria Bulgaria" (impersonating the real Sopra Steria Group, which has separately warned of unrelated impersonation/fraud attempts using similar lookalike domains). Initial contact is made by reviewing candidate resumes on job platforms and messaging targets directly; conversation is then moved to Telegram for an "HR screening," followed by a fake, English-language technical-interview Zoom call.
During the fake interview, victims are instructed to install a "technical test" VPN client: SopraVPN, a modified fork of the legitimate open-source WireGuard client hosted on SourceForge for apparent legitimacy. The SopraVPN configuration file adds a non-standard directive, "SymmetricKey," which is not part of the real WireGuard config schema. This value is BASE64-encoded and contains a nonce, ciphertext, and authentication tag; it is decrypted with AES-256-GCM using the 32-byte value decoded from the config's own "PrivateKey" field as the key. The encoded components are further obfuscated with a non-standard 64-character BASE64 alphabet, generated by a Fisher-Yates shuffle seeded from a CRC32 hash of the SymmetricKey value itself — a deliberate anti-static-analysis measure layered on top of the encryption.
Once decrypted, the payload is executed via WireGuard's legitimate "PostUp" mechanism (a config directive meant to run an arbitrary shell command after the tunnel interface comes up), giving the trojanized client attacker-controlled code execution disguised as normal VPN setup. On Windows, the PostUp-triggered PowerShell creates a scheduled task that retrieves and executes an additional secondary payload. On Linux, the PostUp payload instead issues a curl request over the now-established WireGuard tunnel itself to fetch and run an attacker-supplied executable — using the malicious VPN's own encrypted channel as the delivery path for the next stage, which also complicates network-level detection since the fetch rides inside the tunnel.
CERT-UA assesses this activity has been ongoing since at least May 2026. It fits the broader UAC-0145/Sandworm pattern of rapidly rotating initial-access tradecraft (the group has separately been observed in the same window using ClickFix fake-CAPTCHA lures and blockchain-hidden C2 against Ukrainian targets) while consistently favoring social-engineering pretexts — job platforms, Signal, Telegram — that abuse trust in a legitimate brand or workflow rather than exploiting a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-1973
Defense Evasion
T1027.010 Command Obfuscation; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
Persistence
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Initial Access
T1566.003 Spearphishing via Service
Command and Control
T1572 Protocol Tunneling; T1573.001 Symmetric Cryptography
Resource Development
T1583.001 Domains; T1585.001 Social Media Accounts; T1587.001 Malware; T1608.001 Upload Malware
Reconnaissance
T1589 Gather Victim Identity Information
stealth
Affected products and versions in UAC-0145 (Sandworm subcluster) trojanizes WireGuard VPN
- N/A (open-source software trojanized; Sopra Steria Group impersonated as a lure, not itself compromised) — WireGuard VPN client (trojanized fork distributed under the name 'SopraVPN')
Vulnerable versions: SopraVPN Windows installer; SopraVPN Linux installer
Remediation for UAC-0145 (Sandworm subcluster) trojanizes WireGuard VPN
Immediate actions
- Block/monitor DNS and web requests to soprasteria-bg.com and any newly-registered soprasteria-* lookalike domains
- Alert recruiting and IT staff that legitimate technical-interview 'VPN test' software is never distributed via SourceForge or third-party download links
- Hunt endpoint and file-share content for WireGuard configuration files containing a non-standard 'SymmetricKey' directive
- Review scheduled tasks created around the time of any unapproved VPN client installation on Windows hosts
Workarounds
- Do not install VPN clients or configuration files supplied as part of a job-interview 'technical test'; obtain WireGuard exclusively from wireguard.com or official OS package repositories
Longer-term hardening
- Require managed devices with EDR for any remote-access/VPN use during candidate interviews or onboarding, regardless of employment status
- Restrict installation of unapproved VPN/networking client software via application allowlisting
- Train recruiting and IT staff on job-interview-themed social engineering chains (job-platform contact -> Telegram HR screening -> Zoom technical interview -> malicious 'test' software)
- Monitor for anomalous PowerShell, scheduled-task creation, or curl/network activity immediately following establishment of a new VPN tunnel
Timeline of UAC-0145 (Sandworm subcluster) trojanizes WireGuard VPN
- CERT-UA assesses the UAC-0145 fake IT-recruitment / SopraVPN campaign as active since at least May 2026 (exact start date not disclosed in the advisory).
- Operators posing as HR recruiters for a fictitious 'Sopra Steria Bulgaria' hiring process review candidate resumes on job platforms and initiate contact, moving targets to Telegram for screening (approximate timing within the campaign window).
- English-speaking operators conduct fake technical-interview Zoom calls with targeted system administrators and IT staff, building the pretext to deliver a VPN 'technical test' (approximate timing within the campaign window).
- Victims are directed to download the trojanized WireGuard client 'SopraVPN,' hosted on SourceForge, under the Sopra Steria Bulgaria interview pretext (approximate timing within the campaign window).
- Windows variant registers a scheduled task to retrieve a secondary payload; Linux variant instead issues curl over the established WireGuard tunnel to fetch an attacker-hosted executable (approximate timing within the campaign window).
- On tunnel-up, SopraVPN's WireGuard 'PostUp' hook decrypts the AES-256-GCM 'SymmetricKey' config value (keyed on the decoded 'PrivateKey') and executes the resulting attacker PowerShell on Windows hosts (approximate timing within the campaign window).
- CERT-UA advisory article #6318863 documenting the UAC-0145 / SopraVPN campaign ingested by the TL-Intel Harness HUNT phase (the article's own publication date is not disclosed by the source).
Sources cited for UAC-0145 (Sandworm subcluster) trojanizes WireGuard VPN
- CERT-UA article 6318863: UAC-0145 fake IT recruitment / SopraVPN campaign
- MITRE ATT&CK Group Profile: Sandworm Team (G0034)
- UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices with Malware
- Primary Compromise Vectors Used by UAC-0145 (as of July 2026)
- Sopra Steria: Warning alert - scam / identity theft
Threats related to UAC-0145 (Sandworm subcluster) trojanizes WireGuard VPN
Detection coverage for TL-2026-1973
As of 2026-08-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1973 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.