UAC-0145 (Sandworm/APT44) Trojanizes WireGuard VPN Client 'SopraVPN' via Fake IT Recruitment Scheme
UAC-0145 (Sandworm/APT44) Trojanizes WireGuard VPN Client (TL-2026-1994), also tracked as SopraVPN campaign, is a high-severity malware campaign, first published 2026-08-12. It is attributed to UAC-0145 (Russia) with high confidence, affects UAC-0145 (trojanized WireGuard fork) SopraVPN, maps to 15 MITRE ATT&CK techniques (T1027, T1036.005, T1053.005), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-1994
- Threat ID
- TL-2026-1994
- Also known as
- SopraVPN campaign, Fake Corporate VPN Test
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-08-12
- Last reviewed
- 2026-08-12
- Attribution
- UAC-0145
- Attribution confidence
- HIGH
- Nation-state nexus
- Russia
- Motivation
- ESPIONAGE
- Target sectors
- software services, telecommunication services, it services
- Target regions
- ukraine
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in UAC-0145 (Sandworm/APT44) Trojanizes WireGuard VPN Client
Malware and tooling: COWARDDUCK, GHETTOVIBE, SCOUTCURL, SMARTAXE, telegram, SopraVPN, WireGuard
CERT-UA formally attributed a three-month campaign (advisory #6318863, published 2026-08-09) to UAC-0145, a subcluster of UAC-0002/Sandworm/APT44/Seashell Blizzard tied to Russia's GRU, in which fake IT recruiters lure Ukrainian system administrators through job platforms, Telegram, and a real/AI-persona Zoom interview into installing a trojanized WireGuard client, 'SopraVPN', hosted on SourceForge under a spoofed Sopra Steria brand.
How UAC-0145 (Sandworm/APT44) Trojanizes WireGuard VPN Client works
UAC-0145 conducts reconnaissance on Ukrainian job-search platforms, identifying system administrators and IT specialists by their resumes. Posing as the fictitious 'ATLAS Business Group' recruiting on behalf of a spoofed 'Sopra Steria Bulgaria' (domain soprasteria-bg.com, mimicking the legitimate Sopra Steria consultancy), operators contact candidates through the job platform's built-in chat, then move the conversation to Telegram for an HR-style screening that covers general work questions and English proficiency. A first Zoom videoconference follows with an English-speaking interviewer (reportedly aged 30-35, of uncertain authenticity — press reporting notes it is unclear whether the participant was a real person or an AI-generated persona) to build trust; instructions and a WireGuard configuration file for a 'technical assessment' are then sent by email, and a second Zoom session is held to walk the candidate through the assessment itself, during which the malicious VPN client is introduced.
Victims are emailed WireGuard configuration files (from a spoofed sender such as mike.weitzman@soprasteria-bg.com) to connect to a fake 'corporate VPN' for the assessment. When the standard client throws a connection error, the operators direct the victim to a modified client, 'SopraVPN', distributed via three SourceForge project pages (soprabulgariavpn, sopravpn, soprasteriavpn). SopraVPN is compiled from genuine WireGuard source code but adds a non-standard 'SymmetricKey' configuration option holding a Base64-encoded AES-256-GCM nonce, ciphertext, and authentication tag. At runtime the client decodes the config's 'PrivateKey' field into a 32-byte AES key, decrypts the embedded PowerShell/shell script, and passes it to WireGuard's legitimate runScriptCommand mechanism (the same code path used for PostUp commands) — achieving covert code execution disguised as normal VPN configuration parsing. To further frustrate static analysis, the trojanized client replaces WireGuard's standard Base64 alphabet with a custom, dynamically permuted 64-character alphabet generated by a Fisher-Yates shuffle seeded from the CRC32 hash of the literal string 'SymmetricKey'; the PrivateKey and PublicKey fields are encoded with this non-standard alphabet, rendering them unreadable to stock Base64 decoders.
On Windows, the decrypted PowerShell registers a scheduled task that retrieves a second-stage payload from attacker-controlled infrastructure. On Linux, the decrypted shell payload uses cURL to fetch a second-stage executable over the established WireGuard tunnel, using a DNS server address supplied in the VPN configuration to reach attacker systems; CERT-UA and press reporting note the exact nature of this second-stage payload is not yet disclosed. UAC-0145 is documented separately (June-July 2026) running parallel ClickFix fake-CAPTCHA and torrent/Signal-based compromise chains using tools including SMARTAXE, GHETTOVIBE, SCOUTCURL, FREAKYPOLL, FLUIDLEECH, LOADLOOP, and the Android backdoor COWARDDUCK — illustrating the same actor's broader, actively evolving multi-vector tradecraft during this operational window, though these tools are not confirmed as the stage-2 payload of this specific WireGuard campaign.
MITRE ATT&CK techniques used in TL-2026-1994
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
Persistence
Execution
T1059.001 PowerShell; T1059.004 Unix Shell; T1204.002 Malicious File
Initial Access
T1566.001 Spearphishing Attachment
Command and Control
Resource Development
T1583.001 Domains; T1585.001 Social Media Accounts; T1585.002 Email Accounts; T1608.001 Upload Malware
Reconnaissance
Affected products and versions in UAC-0145 (Sandworm/APT44) Trojanizes WireGuard VPN Client
- UAC-0145 (trojanized WireGuard fork) — SopraVPN
Vulnerable versions: all builds distributed via the soprabulgariavpn, sopravpn, and soprasteriavpn SourceForge projects - Microsoft — Windows
Vulnerable versions: any Windows host on which SopraVPN's decrypted PowerShell stage executes - Linux (general) — Linux
Vulnerable versions: any Linux host on which SopraVPN's decrypted shell stage executes cURL
Remediation for UAC-0145 (Sandworm/APT44) Trojanizes WireGuard VPN Client
Immediate actions
- Verify VPN client installers against official signed WireGuard releases before installation; never install a VPN client received as part of a recruitment or interview process.
- Block/monitor the spoofed domain soprasteria-bg.com and the three malicious SourceForge project URLs (soprabulgariavpn, sopravpn, soprasteriavpn) at DNS and perimeter layers.
- Alert IT and sysadmin staff to the fake-recruitment pattern (job-platform contact -> Telegram -> Zoom interview -> VPN 'technical test') and require out-of-band verification of any interview-issued executable.
- Restrict corporate resource and privileged-account access to managed, EDR-monitored devices only, per CERT-UA guidance.
Workarounds
- Inspect any WireGuard configuration file for a non-standard 'SymmetricKey' field before use; legitimate WireGuard configs never include this option.
- Where a candidate-supplied VPN client cannot be avoided, run it in an isolated/sandboxed environment and monitor outbound connections and process trees before granting it any network access to production systems.
Longer-term hardening
- Deploy EDR with behavioral detection tuned to flag scheduled-task creation and PowerShell/cURL child processes spawned by VPN client processes.
- Require all third-party VPN/remote-access software to be sourced only from vetted internal repositories, never from candidate-supplied links, SourceForge, or torrent mirrors.
- Continuously monitor recruitment-adjacent channels (job-platform messaging, Telegram) for impersonation of the organization's own recruiters or brand.
- Train IT staff and hiring teams on recruitment-themed social engineering, a tactic now also used by North Korean and Chinese state actors against similar personnel.
Timeline of UAC-0145 (Sandworm/APT44) Trojanizes WireGuard VPN Client
- UAC-0145 (Sandworm/APT44 subcluster) begins the recruitment-themed social engineering campaign against Ukrainian system administrators and IT specialists; CERT-UA describes activity as observed 'since at least May 2026' (exact start date within the month not specified).
- CERT-UA and vendor reporting document UAC-0145 running parallel ClickFix fake-CAPTCHA and torrent/Signal-based compromise chains (SMARTAXE, GHETTOVIBE, SCOUTCURL, and other tools), showing the actor's broader multi-vector tradecraft during the same operational window as the WireGuard campaign.
- CERT-UA publishes advisory #6318863 formally attributing the three-month fake-recruitment / trojanized-WireGuard operation to UAC-0145 (UAC-0002/Sandworm/APT44/Seashell Blizzard), affiliated with Russia's GRU.
- SOCPrime publishes 'UAC-0145 Uses Recruitment Lures to Target IT Pros' (10 Aug 2026, 17:21 UTC), an early detection-content analysis of the CERT-UA advisory ahead of the mainstream-media coverage wave the following day.
- BleepingComputer, The Hacker News, The Record, and TechTimes publish coverage of the CERT-UA advisory, adding technical detail on the SopraVPN trojanization mechanism, SourceForge distribution, and the fake 'ATLAS Business Group'/Sopra Steria recruitment pretext.
- GBHackers publishes 'Fake Corporate VPN Test Used to Deliver Trojanized WireGuard Client to IT Admins,' the source article that triggered this threat-intel record.
Sources cited for UAC-0145 (Sandworm/APT44) Trojanizes WireGuard VPN Client
- CERT-UA Advisory #6318863: UAC-0145 Fake Recruitment / Trojanized WireGuard Campaign
- Fake Corporate VPN 'Test' Used to Deliver Trojanized WireGuard Client to IT Admins
- Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
- Sandworm hackers target IT pros with trojanized WireGuard VPN client
- Russian military hackers pose as recruiters to target Ukrainian IT workers
- UAC-0145 Uses Recruitment Lures to Target IT Pros
- UAC-0145 Uses Torrents, Signal, and ClickFix for Access
- UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices with Malware
- UAC-0145 Threat Actor Profile
- Sandworm Recruiter Scam Targets Ukrainian Sysadmins, Deploys Hidden WireGuard Trojan
Threats related to UAC-0145 (Sandworm/APT44) Trojanizes WireGuard VPN Client
Detection coverage for TL-2026-1994
As of 2026-08-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1994 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.