# UAC-0145 (Sandworm subcluster) trojanizes WireGuard VPN client "SopraVPN" in fake IT recruitment campaign impersonating Sopra Steria Bulgaria

> CERT-UA reports UAC-0145, a Sandworm/APT44/Seashell Blizzard subcluster (rolled up under UAC-0002), running fake IT-recruitment operations impersonating Sopra Steria Bulgaria to target system administrators and IT professionals at telecom and IT companies. Victims are lured via fake HR/Telegram screening and Zoom technical interviews into installing a trojanized WireGuard client ("SopraVPN") hosted on SourceForge whose config embeds a custom AES-256-GCM "SymmetricKey" option that decrypts and executes attacker PowerShell via WireGuard's "PostUp" hook.

- **Published:** 2026-08-10T00:00:00Z
- **Last reviewed:** 2026-08-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1973
- **ID:** TL-2026-1973
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UAC-0145 (Russia)
- **Detections:** 9 · **IOCs:** 9 (full data via the Threadlinqs MCP server — Purple tier)

## Description

UAC-0145 is a CERT-UA-tracked subcluster of Sandworm (APT44/Seashell Blizzard, GRU-affiliated, rolled up under the umbrella designation UAC-0002) running a targeted social-engineering campaign against Ukrainian system administrators, IT professionals, and telecom-sector staff. Operators pose as recruiters for a fictitious hiring process branded as "Sopra Steria Bulgaria" (impersonating the real Sopra Steria Group, which has separately warned of unrelated impersonation/fraud attempts using similar lookalike domains). Initial contact is made by reviewing candidate resumes on job platforms and messaging targets directly; conversation is then moved to Telegram for an "HR screening," followed by a fake, English-language technical-interview Zoom call.

During the fake interview, victims are instructed to install a "technical test" VPN client: SopraVPN, a modified fork of the legitimate open-source WireGuard client hosted on SourceForge for apparent legitimacy. The SopraVPN configuration file adds a non-standard directive, "SymmetricKey," which is not part of the real WireGuard config schema. This value is BASE64-encoded and contains a nonce, ciphertext, and authentication tag; it is decrypted with AES-256-GCM using the 32-byte value decoded from the config's own "PrivateKey" field as the key. The encoded components are further obfuscated with a non-standard 64-character BASE64 alphabet, generated by a Fisher-Yates shuffle seeded from a CRC32 hash of the SymmetricKey value itself — a deliberate anti-static-analysis measure layered on top of the encryption.

Once decrypted, the payload is executed via WireGuard's legitimate "PostUp" mechanism (a config directive meant to run an arbitrary shell command after the tunnel interface comes up), giving the trojanized client attacker-controlled code execution disguised as normal VPN setup. On Windows, the PostUp-triggered PowerShell creates a scheduled task that retrieves and executes an additional secondary payload. On Linux, the PostUp payload instead issues a curl request over the now-established WireGuard tunnel itself to fetch and run an attacker-supplied executable — using the malicious VPN's own encrypted channel as the delivery path for the next stage, which also complicates network-level detection since the fetch rides inside the tunnel.

CERT-UA assesses this activity has been ongoing since at least May 2026. It fits the broader UAC-0145/Sandworm pattern of rapidly rotating initial-access tradecraft (the group has separately been observed in the same window using ClickFix fake-CAPTCHA lures and blockchain-hidden C2 against Ukrainian targets) while consistently favoring social-engineering pretexts — job platforms, Signal, Telegram — that abuse trust in a legitimate brand or workflow rather than exploiting a software vulnerability.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1587.001 Malware
- T1608.001 Upload Malware
- T1566.003 Spearphishing via Service
- T1684.001 Impersonation
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1027.010 Command Obfuscation
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1572 Protocol Tunneling
- T1573.001 Symmetric Cryptography

## Sources

- [CERT-UA article 6318863: UAC-0145 fake IT recruitment / SopraVPN campaign](https://cert.gov.ua/article/6318863)
- [MITRE ATT&CK Group Profile: Sandworm Team (G0034)](https://attack.mitre.org/groups/G0034/)
- [UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices with Malware](https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html)
- [Primary Compromise Vectors Used by UAC-0145 (as of July 2026)](https://socprime.com/active-threats/primary-compromise-vectors-used-by-uac-0145-as-of-july-2026/)
- [Sopra Steria: Warning alert - scam / identity theft](https://www.soprasteria.com/footer/warning-alert-scam-identify-theft)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1973