# UAC-0145 (Sandworm/APT44) Trojanizes WireGuard VPN Client 'SopraVPN' via Fake IT Recruitment Scheme

> CERT-UA formally attributed a three-month campaign (advisory #6318863, published 2026-08-09) to UAC-0145, a subcluster of UAC-0002/Sandworm/APT44/Seashell Blizzard tied to Russia's GRU, in which fake IT recruiters lure Ukrainian system administrators through job platforms, Telegram, and a real/AI-persona Zoom interview into installing a trojanized WireGuard client, 'SopraVPN', hosted on SourceForge under a spoofed Sopra Steria brand.

- **Published:** 2026-08-12T00:00:00Z
- **Last reviewed:** 2026-10-06T18:35:22.650Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1994
- **ID:** TL-2026-1994
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** UAC-0145 (Russia)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

UAC-0145 conducts reconnaissance on Ukrainian job-search platforms, identifying system administrators and IT specialists by their resumes. Posing as the fictitious 'ATLAS Business Group' recruiting on behalf of a spoofed 'Sopra Steria Bulgaria' (domain soprasteria-bg.com, mimicking the legitimate Sopra Steria consultancy), operators contact candidates through the job platform's built-in chat, then move the conversation to Telegram for an HR-style screening that covers general work questions and English proficiency. A first Zoom videoconference follows with an English-speaking interviewer (reportedly aged 30-35, of uncertain authenticity — press reporting notes it is unclear whether the participant was a real person or an AI-generated persona) to build trust; instructions and a WireGuard configuration file for a 'technical assessment' are then sent by email, and a second Zoom session is held to walk the candidate through the assessment itself, during which the malicious VPN client is introduced.

Victims are emailed WireGuard configuration files (from a spoofed sender such as mike.weitzman@soprasteria-bg.com) to connect to a fake 'corporate VPN' for the assessment. When the standard client throws a connection error, the operators direct the victim to a modified client, 'SopraVPN', distributed via three SourceForge project pages (soprabulgariavpn, sopravpn, soprasteriavpn). SopraVPN is compiled from genuine WireGuard source code but adds a non-standard 'SymmetricKey' configuration option holding a Base64-encoded AES-256-GCM nonce, ciphertext, and authentication tag. At runtime the client decodes the config's 'PrivateKey' field into a 32-byte AES key, decrypts the embedded PowerShell/shell script, and passes it to WireGuard's legitimate runScriptCommand mechanism (the same code path used for PostUp commands) — achieving covert code execution disguised as normal VPN configuration parsing. To further frustrate static analysis, the trojanized client replaces WireGuard's standard Base64 alphabet with a custom, dynamically permuted 64-character alphabet generated by a Fisher-Yates shuffle seeded from the CRC32 hash of the literal string 'SymmetricKey'; the PrivateKey and PublicKey fields are encoded with this non-standard alphabet, rendering them unreadable to stock Base64 decoders.

On Windows, the decrypted PowerShell registers a scheduled task that retrieves a second-stage payload from attacker-controlled infrastructure. On Linux, the decrypted shell payload uses cURL to fetch a second-stage executable over the established WireGuard tunnel, using a DNS server address supplied in the VPN configuration to reach attacker systems; CERT-UA and press reporting note the exact nature of this second-stage payload is not yet disclosed. UAC-0145 is documented separately (June-July 2026) running parallel ClickFix fake-CAPTCHA and torrent/Signal-based compromise chains using tools including SMARTAXE, GHETTOVIBE, SCOUTCURL, FREAKYPOLL, FLUIDLEECH, LOADLOOP, and the Android backdoor COWARDDUCK — illustrating the same actor's broader, actively evolving multi-vector tradecraft during this operational window, though these tools are not confirmed as the stage-2 payload of this specific WireGuard campaign.

## MITRE ATT&CK

- T1591.004 Identify Roles
- T1598.001 Spearphishing Service
- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1608.001 Upload Malware
- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.004 Unix Shell
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1572 Protocol Tunneling
- T1566.003 Spearphishing via Service
- T1566.002 Spearphishing Link
- T1656 Impersonation
- T1027.013 Encrypted/Encoded File
- T1105 Ingress Tool Transfer

## Sources

- [CERT-UA Advisory #6318863: UAC-0145 Fake Recruitment / Trojanized WireGuard Campaign](https://cert.gov.ua/article/6318863)
- [Fake Corporate VPN 'Test' Used to Deliver Trojanized WireGuard Client to IT Admins](https://gbhackers.com/fake-corporate-vpn-test/)
- [Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands](https://thehackernews.com/2026/08/sandworm-linked-uac-0145-uses-fake-job.html)
- [Sandworm hackers target IT pros with trojanized WireGuard VPN client](https://www.bleepingcomputer.com/news/security/sandworm-hackers-target-it-pros-with-trojanized-wireguard-vpn-client/)
- [Russian military hackers pose as recruiters to target Ukrainian IT workers](https://therecord.media/russian-military-hackers-pose-as-recruiters-ukraine-it-workers)
- [UAC-0145 Uses Recruitment Lures to Target IT Pros](https://socprime.com/active-threats/uac-0145-targets-victims-through-recruitment-themed-social-engineering/)
- [UAC-0145 Uses Torrents, Signal, and ClickFix for Access](https://socprime.com/active-threats/primary-compromise-vectors-used-by-uac-0145-as-of-july-2026/)
- [UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices with Malware](https://thehackernews.com/2026/07/uac-0145-uses-clickfix-captchas-to.html)
- [UAC-0145 Threat Actor Profile](https://mallory.ai/actors/019f66d2-3d6b-7500-a4d7-65a3cd19d7d7)
- [Sandworm Recruiter Scam Targets Ukrainian Sysadmins, Deploys Hidden WireGuard Trojan](https://www.techtimes.com/articles/323950/20260811/sandworm-recruiter-scam-targets-ukrainian-sysadmins-deploys-hidden-wireguard-trojan.htm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1994