# Sandworm-linked UAC-0145 Uses Fake Job Offers to Deliver Trojanized WireGuard VPN Client (SopraVPN)

> UAC-0145, a Russian GRU-affiliated Sandworm/APT44/Seashell Blizzard sub-cluster, has run a fake-recruiter social-engineering campaign against Ukrainian IT professionals and system administrators since at least May 2026. Victims lured via job sites, Telegram, and a Zoom 'interview' are pushed to download a trojanized WireGuard VPN client ('SopraVPN') from SourceForge that hides AES-256-GCM-encrypted PowerShell commands (Windows) or triggers a cURL-based secondary payload fetch (Linux) inside its own configuration file.

- **Published:** 2026-08-11T00:00:00Z
- **Last reviewed:** 2026-08-11T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1988
- **ID:** TL-2026-1988
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Sandworm (Russia)
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

CERT-UA (advisory 6318863, published 2026-08-09) documented a multi-stage social-engineering operation run by UAC-0145, a sub-cluster of the Russian GRU-linked UAC-0002/Sandworm activity, tracked elsewhere as APT44 and Seashell Blizzard. Operators trawl legitimate Ukrainian job-search sites for IT professionals and system administrators, review candidate resumes, and make first contact through the site's built-in chat while posing as recruiters for the real IT firm ATLAS Business Group. The conversation is moved to Telegram, where a fabricated HR manager claiming to represent Sopra Steria Bulgaria (a real, unaffiliated European IT/consulting company) conducts a preliminary screening on work history and English proficiency, then schedules a Zoom videoconference with an English-speaking interviewer whose authenticity CERT-UA could not confirm (possibly AI-generated).

As part of a purported technical assessment, the fake employer emails the candidate a WireGuard VPN configuration file that is deliberately broken, then recommends the candidate instead install a custom 'SopraVPN' client, distributed from SourceForge project pages under the fake domain soprasteria-bg.com. The SopraVPN binary is a genuine WireGuard build modified by the attackers: it adds a non-standard 'SymmetricKey' configuration option whose value is BASE64-encoded AES-256-GCM ciphertext (nonce + ciphertext + authentication tag), and repurposes the 32-byte value normally used for the legitimate 'PrivateKey' field as the AES-256 decryption key. Once decrypted, the resulting PowerShell code is executed through WireGuard's own 'runScriptCommand' hook, giving the attacker command execution on the endpoint disguised as normal VPN client behavior. On Windows, the payload creates a scheduled task to fetch and run a second-stage payload; on Linux, the client uses cURL to pull an additional executable from attacker infrastructure over the already-established VPN tunnel. The PowerShell payload is further obfuscated with a custom BASE64 alphabet generated via a Fisher-Yates shuffle prior to encryption. As of public disclosure, all three known SourceForge project pages (soprabulgariavpn, sopravpn, soprasteriavpn) were unavailable.

CERT-UA and multiple outlets attribute the campaign with high confidence to UAC-0145/Sandworm/GRU, noting it is the third distinct Sandworm-linked operation disclosed since July 2026 (following a June/July 2026 ClickFix fake-CAPTCHA campaign against Ukrainian websites), consistent with a GRU cyber directorate running several parallel tracks against Ukrainian IT and telecommunications targets. No CVE or software vulnerability is involved; the entire chain relies on social engineering plus a trojanized, self-authored VPN client rather than exploitation of a flaw in upstream WireGuard.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1585 Establish Accounts
- T1583.001 Domains
- T1587.001 Malware
- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1059.001 PowerShell
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1684.001 Impersonation
- T1572 Protocol Tunneling

## Sources

- [Sandworm-Linked UAC-0145 Uses Fake Job Offers to Push Trojanized WireGuard VPN Client](https://thehackernews.com/2026/08/sandworm-linked-uac-0145-uses-fake-job.html)
- [Соціальна інженерія у виконанні UAC-0145: компрометація у процесі працевлаштування](https://cert.gov.ua/article/6318863)
- [Sandworm Recruiter Scam Targets Ukrainian Sysadmins, Deploys Hidden WireGuard Trojan](https://www.techtimes.com/articles/323950/20260811/sandworm-recruiter-scam-targets-ukrainian-sysadmins-deploys-hidden-wireguard-trojan.htm)
- [Russian military hackers pose as recruiters to target Ukrainian IT workers](https://therecord.media/russian-military-hackers-pose-as-recruiters-ukraine-it-workers)
- [UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices with Malware](https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html)
- [Кібератака під виглядом працевлаштування: CERT-UA викрила нову схему хакерів Sandworm](https://expert.com.ua/217623-kiberataka-pid-vihlyadom-pracevlashtuvannya-cert-ua-vikrila-novu-shemu-hakeriv-sandworm.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1988