Cybersecurity experts have been sounding the alarm about a sophisticated social engineering campaign, attributed to the notorious Russian threat group Sandworm. This campaign targets IT professionals and system administrators with fake job offers, tricking them into downloading a trojanized VPN client that compromises their systems.
The Ukrainian Computer Emergency Response Team (CERT-UA) has been tracking this campaign since at least May, identifying it as a sub-cluster of Sandworm (APT44). The threat actor poses as IT companies and recruiters, studying the victims’ resumes on job sites before initiating direct contact via Telegram. Conversations are then moved to Zoom for video interviews, where mock technical assignments are given that require connecting to a corporate VPN using WireGuard.
Here’s how it works: during the interview, additional instructions are sent via email, including configuration files for connecting to the “corporate” VPN. The downloaded file is configured to produce a fake error, prompting the victim to download a modified WireGuard-based client called “SopraVPN” from SourceForge. This client has been compromised by the attackers, who have replaced WireGuard’s standard Base64 decoding with a custom, dynamically generated alphabet that renders key strings unreadable with standard decoders.
The trojanized client supports a malicious configuration option called “SymmetricKey”, which decrypts and executes embedded PowerShell code. On Windows, this code creates a scheduled task and downloads an additional payload from the Internet; on Linux, it uses cURL to retrieve another executable from attacker-controlled infrastructure through the VPN. The attackers’ goal is to gain access to the victim’s system, allowing them to move laterally within the network.
This campaign is particularly concerning because it targets critical infrastructure and government entities, both in Ukraine and internationally. Sandworm has a history of sophisticated attacks, and this latest campaign demonstrates their ability to adapt and evolve their tactics. The CERT-UA recommends that telecommunications providers and IT companies restrict corporate resource access to managed, continuously monitored devices protected by EDR, including when employees use personal equipment.
For individual IT professionals, it’s essential to be vigilant about job offers and technical interviews. Be cautious of unsolicited contact via Telegram or other messaging apps, and never download software from untrusted sources. If you’re unsure about the legitimacy of a job offer or a VPN client, don’t hesitate to reach out to your organization’s security team for guidance.
In the age of remote work, cybersecurity threats are becoming increasingly sophisticated. Staying informed and being proactive about online safety is crucial for protecting yourself and your organization from these types of attacks.
Source: Bleeping Computer — 2026-08-11