Skip to main content

AI Cert USA

The Job Interview That Installs Malware: How Russia’s Sandworm Is Targeting IT Professionals With a Trojanized VPN

Red padlock over WireGuard configuration text with the headline The Interview That Installs Malware

If you are a system administrator or developer and a recruiter reaches out with an attractive offer, a friendly Telegram chat, and a Zoom interview, you may want to slow down before the “technical assessment” stage. Ukraine’s national cyber incident response team, CERT-UA, has exposed a campaign in which Russian state-backed hackers pose as recruiters and use a fake hiring process to trick IT professionals into installing a booby-trapped VPN client.

The operation has been attributed to UAC-0145, a sub-cluster of Sandworm, the notorious group linked to Russia’s GRU military intelligence service. Sandworm, also tracked as APT44 and Seashell Blizzard, has been active for more than a decade and is blamed for some of the most disruptive cyberattacks on record, including attacks on Ukraine’s electricity grid. According to CERT-UA, this recruitment-themed campaign has been running since at least May 2026.

A hiring process built to look real

What sets this campaign apart is how patient and polished the social engineering is. Rather than blasting out phishing emails, the attackers start by browsing legitimate Ukrainian job sites, reading the resumes of system administrators and developers, and then contacting promising candidates directly through the platform’s messaging, posing as recruiters for a company called “Atlas Business Group.”

From there, the conversation moves to Telegram, where a supposed HR manager asks ordinary screening questions about work preferences. Next comes a preliminary video interview over Zoom, conducted in English by a man who appears to be in his early to mid-thirties. CERT-UA noted the interviewer could have been AI-generated, but the meeting looks enough like a real conversation to keep candidates engaged.

The final stage is the trap. Candidates are invited to a technical assessment on behalf of Sopra Steria Bulgaria, a real subsidiary of the French IT services multinational Sopra Steria. The attackers built a lookalike website and used email addresses crafted to resemble the company’s regional office, lending the whole exercise an air of legitimacy. The instructions ask the candidate to connect to a “corporate” WireGuard VPN before starting the mock assignment.

The deliberate failure

Here is the clever part. The VPN configuration files sent to the candidate are designed to fail. When the connection throws an error, the “recruiter” helpfully suggests that the candidate download a custom client called “SopraVPN” instead. That client was hosted on SourceForge, a well-known and widely trusted software repository, under project names such as “sopravpn,” “soprabulgariavpn,” and “soprasteriavpn.” Because SourceForge is a legitimate site that is often allowed through corporate web filters, the download raises far fewer red flags than a link to an unknown domain would.

What is hiding inside SopraVPN

SopraVPN is built from the open-source WireGuard code base, and it does actually establish a VPN connection so nothing looks amiss. But the attackers made a handful of critical modifications.

The trojanized client recognizes a non-standard configuration option called “SymmetricKey,” which does not exist in legitimate WireGuard. That option carries an encrypted payload. When the tunnel starts, the client decodes the configuration’s PrivateKey into a 32-byte AES-256 key and uses it to decrypt the SymmetricKey data with AES-256-GCM. The decrypted payload is then handed to WireGuard’s standard script-running mechanism and executed.

On Windows, that payload is PowerShell code that creates a scheduled task and downloads additional malware from a remote server. On Linux, the client uses cURL to fetch executable files through the VPN tunnel itself. The attackers also replaced WireGuard’s standard Base64 decoding with a custom, dynamically generated alphabet, which makes the embedded code harder to spot and analyze.

The design has a nasty evasion advantage. Security tools that inspect application binaries generally do not scan VPN configuration files for encrypted payloads. As TechTimes put it, “the malicious code is not in the application; it is in the config.” From the operating system’s point of view, the malicious PowerShell execution looks like ordinary VPN interface initialization.

CERT-UA did not disclose how many people were compromised or what the attackers’ ultimate objective was. The Record reported that the Telegram account used in the scheme was still active at the time of publication, although the associated job advertisement had been taken down.

Why IT professionals are the target

The choice of victims is no accident. System administrators and developers hold the keys to enterprise infrastructure, managing credentials, access controls, backups, and network configuration across entire organizations. Compromising one administrator’s personal laptop can be a springboard into the corporate network, especially when employees use personal devices to reach work resources.

The tactic also echoes a playbook that other state-backed groups have used for years. North Korean and Chinese threat actors have run similar fake-recruitment operations against government, military, and technology workers, and Sandworm’s version shows the technique is spreading among nation-state adversaries. This campaign also follows an earlier UAC-0145 operation in July 2026 that used “ClickFix”-style lures to deliver information-stealing malware in Ukraine.

How to protect yourself and your organization

For individuals, the advice from CERT-UA and security researchers is consistent. Never install software provided by a prospective employer before you have accepted an offer, and treat any request to install a custom VPN, alter a configuration, or download a tool from an external site as a stop sign. Verify a recruiter’s identity through the company’s official website and contact channels rather than the details they give you. If a technical task does require network access, run it in an isolated, disposable environment, never on your primary workstation. And take a moment to inspect any VPN configuration file before importing it; an unfamiliar option such as “SymmetricKey” is a giveaway.

For organizations, CERT-UA recommends allowing access to corporate resources only from managed, continuously monitored devices protected by endpoint detection and response (EDR), including when employees work from personal equipment. Security teams can also consider application-control policies that block unsigned PowerShell scripts and monitoring for unexpected scheduled-task creation.

The broader lesson is simple: a job offer is now a legitimate attack surface. When the interview process starts asking you to install things, the most important skill you can demonstrate is knowing when to say no.

Sources

Share the Post:

Related Posts