A new campaign from the threat group UAC-0145 (linked to Sandworm) focuses on social engineering: criminals approach IT staff with fake hiring and then try to have them install a false VPN. The goal seems straightforward—convince victims they need to complete a technical assessment—while malware-related steps follow in reality.
According to the Ukrainian CERT (CERT-UA), the activity has been ongoing since May 2026. The attack is especially notable because the “VPN solution” isn’t only meant to enable connections; it can also be abused to execute commands on the victim’s system.
How UAC-0145 uses fake job interviews
The attack starts on job boards. After the attackers review a CV, they reach out to a potential candidate—often a system administrator or other IT specialist—on behalf of an IT company. In CERT-UA’s report, an example name is provided, but the mechanism is mainly recruitment contact.
Initially, the conversations take place via the job platforms’ built-in chat features. Next, interaction shifts to messaging apps such as Telegram. At that stage, the attackers conduct a pre-screening interview with questions about the role and English language skills, while a person posing as an HR employee would supposedly handle screening.
After that, the victim is invited to a Zoom video interview. CERT-UA notes that it is unclear whether the person shown on camera is a real individual or a synthetic profile generated with AI.
From the Zoom call to the technical “VPN test”
After the interview, the attackers send additional instructions by email. These include a technical component the victim must complete: using a configuration file to establish a connection to the corporate VPN. The instructions reference WireGuard and completing an “assessment”. A second Zoom meeting is also announced, in which the testing is monitored.
The problem begins when the victim actually tries to connect using the provided configurations. The VPN client returns errors. Instead of stopping at those errors, the attackers use the classic turning point in social engineering: they recommend downloading a custom VPN.
This custom VPN is delivered through fake links that mimic the webpage of a legitimate European consulting and software company. CERT-UA mentions domain variants resembling “Sopra Steria Bulgaria”, but the security service classifies them as misleading. The download would take place via projects on SourceForge, which—according to the report—would not be available as standard downloads.
Why the “WireGuard” variant is truly dangerous
According to CERT-UA, the core trick is that the attackers modified the WireGuard codebase and then compiled it into a client with additional functionality. As a result, it doesn’t work like a “standard VPN client”; instead, the software can handle configuration settings in a customized way.
Specifically, CERT-UA describes that support was added for a non-standard option, “SymmetricKey”. The value contains data encoded in BASE64, including components that map to AES-256-GCM (including a nonce, ciphertext, and an authentication tag).
During decoding and decryption, a 32-byte value is derived from a field (“PrivateKey”) as the cryptographic key. What follows is the real risk: the decrypted content is passed to the mechanism through which WireGuard can execute commands tied to configuration options—especially the option known for scripts/commands when setting up connections.
In plain terms, the modified VPN client can run arbitrary commands on the victim’s host system without the person consciously agreeing to it—or even realizing it.
Windows and Linux: extra steps toward a payload
The campaign isn’t only about manipulating VPN behavior. CERT-UA also describes that the Windows variant uses PowerShell to create a scheduled task that fetches a second payload from an external URL. On Linux, the description notes that cURL is used to download an executable from the attackers’ infrastructure—again, via the VPN.
Which payload follows exactly is not fully clarified in the disclosure. But the direction is clear: installing the VPN serves as a bridge to subsequent steps that can introduce malware.
What this says about modern recruitment scams
UAC-0145’s approach fits into a broader trend: attackers use false recruitment processes to gain access to target devices. CERT-UA places the report in context by pointing to earlier campaigns where social engineering also led to IT-system infections.
Notably, the attack doesn’t rely on a single simple click. Victims go through multiple steps: CV screening, messages via chat platforms and Telegram, video interaction via Zoom, emails with technical instructions, and only then the “download or install” phase. This makes the attack more convincing and harder to recognize as phishing.
Practical protection: how to reduce the chance of damage
CERT-UA urges IT professionals to be alert to social engineering techniques and to configure organizations so that infection is less likely. A few concrete measures mentioned in the report:
- Limit access to corporate resources to managed devices running security software.
- Ensure relevant policies are configured so that no random device or process can simply gain access.
- Implement continuous monitoring so suspicious download and execution patterns are detected faster.
In addition, it’s wise to make internal agreements on how technical assessments and VPN instructions are provided. If “VPN configs” are shared via chat and email outside the normal process, that’s a strong signal to request additional verification.
Check: spotting signals of a UAC-0145-like attack
You won’t identify this kind of campaign from a single detail, but from a combination of signals. Look for:
- Unexpected recruiter or HR contacts after a CV is reviewed on a job platform.
- Conversations that move to messaging apps and video calls.
- Emails with technical steps that end with “install something to fix it” when error messages appear.
- Download links that look legitimate, but are offered via external project pages or spoofed domains.
- VPN clients that differ from standard installations or show behavior beyond mere network connectivity.
If you want to read more about similar social engineering and exploit chains, this may be interesting: https://thehackernews.com/2026/08/sandworm-linked-uac-0145-uses-fake-job.html
Source: https://thehackernews.com/2026/08/sandworm-linked-uac-0145-uses-fake-job.html
