A sophisticated social engineering campaign targeting IT profiles

The Ukraine Computer Emergency Response Team (CERT-UA) revealed, on Saturday, August 10, 2026, the details of a particularly elaborate human phishing campaign attributed to the threat cluster UAC-0145, a sub-group operating under the aegis of Sandworm (also tracked under the names APT44, Seashell Blizzard, or UAC-0002), the hacker group affiliated with the GRU, the Russian military intelligence services.

Active since at least May 2026, this operation primarily targets system administrators and IT specialists in Ukraine. The scenario relies on a multi-step social engineering chain, designed to build trust before compromising the victim's machine.

Modus operandi: A fake yet credible recruitment process

The progression is meticulously staged:

  1. Scouting on job sites — The attackers consult resumes posted on legitimate Ukrainian job search platforms and contact potential candidates pretending to be recruiters from an IT company called ATLAS Business Group.
  2. Switching to Telegram — After an initial exchange via the job site's integrated chat, the conversation is moved to Telegram, where a fake HR manager claims to oversee the selection process on behalf of Sopra Steria Bulgaria, a legitimate subsidiary of the European consulting and IT services group Sopra Steria.
  3. Preliminary interview — Ordinary professional questions are asked, as well as an evaluation of the candidate's English proficiency.
  4. Zoom video conference — The candidate is invited to a video call with an English-speaking man, described as being between 30 to 35 years old. CERT-UA specifies that it is impossible to determine whether this person was a real operator or a synthetic persona generated by artificial intelligence.
  5. “Technical interview” — Additional instructions are sent via email, including configuration files to connect to a corporate VPN via WireGuard, supposedly to perform a technical test. The sender's email address is designed to resemble that of a regional office of Sopra Steria.

SopraVPN: A trojanized WireGuard hosted on SourceForge

It is at the VPN connection stage that the trap closes. When the victim tries to use the provided WireGuard configuration files, they encounter error messages. The fake recruiters then recommend downloading a custom VPN client called “SopraVPN,” hosted on the SourceForge platform via links designed to mimic the official site of Sopra Steria Bulgaria (soprasteria-bg[.]com).

Three SourceForge projects have been identified by researchers:

  • sourceforge[.]net/projects/soprabulgariavpn
  • sourceforge[.]net/projects/sopravpn
  • sourceforge[.]net/projects/soprasteriavpn

The Hacker News states that the latter project presented itself, according to Google cache, as an “open-source corporate VPN solution designed for secure remote access.” At the time of analysis, none of these projects were available for download.

The technique: Command execution via a counterfeit configuration option

The SopraVPN client was compiled from the legitimate WireGuard source code, but with substantial modifications. According to CERT-UA:

  • A non-standard option named SymmetricKey was added to the configuration processing mechanism. Its value contains Base64-encoded data corresponding to AES-256-GCM encryption (nonce, ciphertext, and authentication tag).
  • The AES-256 key is derived from decoding the PrivateKey value (32 bytes).
  • The PowerShell code thus decrypted is then passed to WireGuard's runScriptCommand mechanism — the same mechanism legitimately used to execute commands specified by the PostUp option.

In other words, the poisoned VPN allows the attacker to execute arbitrary commands on the victim's machine without their knowledge. Malicious commands are encrypted and embedded in the configuration files, making them hard to detect during a superficial inspection.

Windows and Linux variants

  • On Windows, the VPN client uses a PowerShell command to create a scheduled task that downloads a secondary payload from a remote URL.
  • On Linux, the variant employs cURL to download an executable file from the attackers' infrastructure via the VPN tunnel.

The exact nature of the second-stage payload has not been specified by CERT-UA.

A context of ongoing threat

This campaign is part of a series of operations carried out by Sandworm against Ukraine. Less than a month prior, CERT-UA attributed another campaign to UAC-0145 employing the so-called ClickFix technique — fake CAPTCHA prompts on compromised sites enticing victims to copy-paste a PowerShell command into their Windows terminal. This operation deployed the GhettoVibe malware (access persistence), followed by the reconnaissance tool ScoutCurl, as well as two loaders named FluidLeech and LoadLoop.

The Record further recalls that in recent months, Sandworm has also:

  • Targeted Android devices with malware disguised as security applications, distributed via messaging apps, capable of collecting contacts, files, system information, and real-time location.
  • Distributed backdoored copies of Windows and Office via torrent sites — a vector that allowed, in at least one case, the establishment of a foothold in a Ukrainian governmental network before a destructive cyberattack.
  • Exploited Signal to convince Ukrainian military personnel to install fake antivirus software, sometimes offering cash payments, after weeks of building trust.

A tactic now global

While Sandworm is the most recent actor to adopt fake recruitment practices, the technique is far from new in the threat landscape. As The Record points out:

  • Chinese intelligence services have previously used fake recruiters and consultants on professional platforms to approach personnel with access to sensitive information.
  • North Korean hackers have ramped up phishing campaigns masquerading as recruiters to steal credentials, cryptocurrencies, or compromise employees of tech companies — an operation sometimes referred to as "Contagious Interview."
  • North Korean IT workers themselves seek to be hired under false identities in foreign companies to generate revenue for the benefit of Pyongyang.

Recommendations from CERT-UA

CERT-UA urges IT professionals to exercise increased vigilance against social engineering techniques and recommends organizations to:

  • Restrict access to corporate resources solely to managed devices equipped with appropriate security software.
  • Configure and enforce relevant security policies.
  • Ensure continuous monitoring of systems.

The agency did not specify the number of identified victims nor the ultimate objective of the attackers. The Telegram account used by the fake recruiter from ATLAS Business Group was still accessible at the time of The Record's article, although the associated job offer had been removed.

Sources: