CERT-UA has disclosed a campaign by UAC-0145, a subgroup of Sandworm — the GRU-affiliated actor also tracked as APT44, Seashell Blizzard and UAC-0002. It has been running since May 2026, and it targets Ukrainian system administrators and IT specialists through their job search.

The funnel

  1. Job boards. Attackers pose as recruiters and contact sysadmins and IT specialists.
  2. Telegram. The conversation moves off the job site early.
  3. A fake HR manager from Sopra Steria Bulgaria — a real European consulting firm — runs a preliminary interview.
  4. A Zoom call follows.
  5. Technical interview instructions arrive by email, containing WireGuard VPN configuration files.
  6. The connection fails. The attacker helpfully suggests downloading "SopraVPN" from SourceForge links dressed up to look like the company's site.

Step six is the design. A configuration file that simply worked would end the interaction; one that fails creates a support moment, and a support moment is when a technical person will install a binary someone else recommended.

CERT-UA is careful about the video call:

it's unclear whether the person showing up in the interview was a genuine participant or a synthetic persona generated using artificial intelligence

That uncertainty is now a permanent feature of this threat model. "I saw them on video" has stopped being evidence.

What SopraVPN is

A trojanised WireGuard client — modified genuine code, not a lookalike wrapper.

CERT-UA's description of the mechanism:

support for the non-standard 'SymmetricKey' option has been added to the configuration processing mechanism; its value contains BASE64-encoded data for AES-256-GCM

So the command channel is a configuration option. The VPN reads its config, finds a field the real WireGuard does not have, decrypts it, and executes.

That is a deliberate choice against detection. The binary is mostly real WireGuard and will behave like it. The malicious instruction arrives as data in a config file, which is the least suspicious artifact on a machine belonging to someone who was just asked to set up a VPN.

Windows builds create scheduled tasks that download secondary payloads. Linux builds use cURL.

Why IT staff specifically

The target set is the point. A system administrator is not a lucrative victim in themselves — they are a route. Their machine holds credentials, jump-host access, infrastructure documentation and, often, a VPN into somewhere that matters.

Recruitment is also the one context where sending a technical person an unusual file is completely normal. A take-home task, a test environment, a VPN config for the "internal" interview — none of it looks wrong.

The hiring pipeline is a trusted channel that no security team monitors, and it is being worked from both ends this year — North Korean operatives applying for real jobs, and now a GRU subgroup offering fake ones. In both directions the recruitment process is the attack surface, and in both directions it sits outside anything the security team owns.

What to actually do

  • Tell your admins that a technical interview is a phishing surface. Not as a policy line — as a specific scenario, with the failed-VPN-then-download step named.
  • Any VPN client should come from your own software distribution, not from a link a recruiter sent, even a SourceForge one.
  • Treat "the config didn't work, try this instead" as the signature. The failure is the hook, and it is the most recognisable moment in the chain.
  • Watch for scheduled tasks created shortly after a new VPN install on Windows, and unexpected cURL activity on Linux.
  • Stop treating a video call as identity verification. CERT-UA cannot say whether the interviewer was a person.

The scope CERT-UA describes is Ukrainian IT professionals since May 2026. The technique has nothing Ukraine-specific in it.