Sandworm-Linked UAC-0145 Uses Trojanized WireGuard Client in Fake Job Campaign
Summary
CERT-UA reports that Sandworm-linked UAC-0145 has targeted IT professionals with fake job offers, steering them to a trojanized WireGuard client that executes embedded PowerShell and fetches additional payloads. It recommends limiting corporate access to managed, EDR-
Key points
- CERT-UA says the campaign has targeted system administrators and IT professionals since at least May, using fake job offers and recruiter impersonation.
- Attackers study resumes on job sites, then move conversations to Telegram and Zoom for mock technical interviews requiring a corporate VPN connection.
- In one case, the attackers impersonated Sopra Steria and directed targets to a modified WireGuard-based client called SopraVPN.
- The trojanized client supports a nonstandard “SymmetricKey” option that decrypts and executes embedded PowerShell code.
- On Windows, the malicious command creates a scheduled task and downloads another payload; on Linux, it uses cURL to retrieve an executable through the VPN.
- CERT-UA says the modified client replaces standard Base64 decoding with a dynamically generated alphabet, making key strings harder to decode and the PowerShell code harder to analyze.
- CERT-UA advises targeted organizations to restrict corporate-resource access to managed devices that are continuously monitored and protected by EDR.
Article Details
- Event Type
- A fake job-offer social-engineering campaign attributed to UAC-0145 delivers a trojanized WireGuard-based VPN client.
- Impact
- The campaign targets system administrators and IT professionals, using the trojanized SopraVPN client to execute embedded PowerShell code, download additional payloads, and steal access. The article reports no victim count or confirmed operational damage.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | soprasteria-bg[.]com | Impersonation domain linked from the trojanized-client SourceForge page to lend credibility; the article says it has no connection to the legitimate Sopra Steria. |
MITRE ATT&CK
T1053.005 · Scheduled TaskOn Windows, the malicious command creates a scheduled task.T1059.001 · PowerShellThe trojanized client decrypts and executes embedded PowerShell code.T1105 · Ingress Tool TransferThe client downloads additional payloads, including an executable retrieved with cURL on Linux.T1204.002 · Malicious FileVictims are persuaded to install the trojanized VPN client as part of a mock technical assignment.
Threat Actors
SandwormThe campaign is attributed to UAC-0145, described as linked to Sandworm; the report says UAC-0145 is believed to be a Sandworm sub-cluster.SANDWORM RELICThe article identifies APT44 as another tracking name for Sandworm and says UAC-0145 is believed to be a Sandworm (APT44) sub-cluster; the campaign is attributed to UAC-0145.UAC-0145CERT-UA attributes the fake job-offer campaign to UAC-0145; the article says it is believed to be a sub-cluster of Sandworm (APT44).
Products
SopraVPNVictims are tricked into installing a trojanized WireGuard client called SopraVPN.SourceForge#SandwormTelegramThe campaign uses recruiter impersonation, Telegram, Zoom interviews, and trojanized VPN software to run PowerShell payloads and steal access.WireGuardHackers linked to Sandworm, also tracked as APT44 and UAC-0145, are luring system administrators and IT professionals with fake job offers to deliver malicious WireGuard-based tooling.ZoomThe campaign uses recruiter impersonation, Telegram, Zoom interviews, and trojanized VPN software to run PowerShell payloads and steal access.