Fake recruiters talked IT staff into installing a VPN client that ran hidden code

On 8 August, CERT-UA published an account of how the threat cluster UAC-0145 uses a hiring process as its way in to IT professionals. The attackers read a candidate's CV on job sites and make contact in the name of an IT company, move the conversation to Telegram and hold a genuine Zoom interview in English. The candidate is then sent WireGuard configuration files, and when the connection fails, is urged to download the company's own client, SopraVPN, from SourceForge. The client is built from WireGuard source code, and an extra configuration option called SymmetricKey holds encrypted PowerShell code that the client itself executes. UAC-0145 is a subcluster of UAC-0002, also known as Sandworm, APT44 and Seashell Blizzard, and the activity has been running since at least May 2026.

What happens technically

It starts in the built-in chat on a job site. The attacker has already studied the CV, and the target is usually a system administrator or another IT specialist. Contact is made in the name of an IT company, in one case ATLAS Business Group. The conversation moves to Telegram, where someone presenting themselves as an HR manager describes the project, tied to Sopra Steria Bulgaria. The candidate is asked about working arrangements and English skills, and is given a Zoom link. The meeting genuinely takes place, with a man aged somewhere between 30 and 35, in English. In parallel comes an email with instructions for a technical interview. The sender address is mike.weitzman@soprasteria-bg[.]com, a domain made to look like a regional office of Sopra Steria. The company's own domains are soprasteria.com and soprasteria.bg.

The email carries WireGuard configuration files for Linux and Windows, meant to give the candidate access to the test assignments. The connection returns errors. At that point the attacker suggests downloading the company's own client instead. SopraVPN sits on SourceForge, and the link appears on the fake site soprasteria-bg[.]com under a button labelled “Corporate VPN on Sourceforge”. The client is compiled from WireGuard source code with modifications. It understands an option that WireGuard does not have, called SymmetricKey. The value is BASE64 encoded and holds the nonce, ciphertext and authentication tag for AES-256-GCM. The key is the 32 bytes produced by decoding PrivateKey, the very field the user believes is their own private key. The decrypted PowerShell code is passed to WireGuard's own runScriptCommand, the mechanism that normally runs the commands listed under PostUp.

The BASE64 decoding has been changed as well. PrivateKey and PublicKey are read using a non-standard 64 character alphabet. That alphabet is assembled with a Fisher-Yates shuffle, seeded by the CRC32 sum of the string “SymmetricKey” passed to math/rand. A non-standard alphabet means the same characters become entirely different bytes from what ordinary tools produce. The key fields therefore look unremarkable to anyone who opens the file, and a standard BASE64 decoder does not yield what the client itself reads. On Windows the PowerShell code creates a scheduled task under \Microsoft\Windows\ApplicationData\Microsoft and pulls further code from the internet. On Linux it uses cURL to fetch an executable from the attackers' infrastructure, and that download travels through the VPN tunnel itself. That is why the configuration carries the IP address of a DNS server. The Linux path CERT-UA gives is /usr/libexec/timesyncd-check.

What this means for you if you run IT operations

The uncomfortable part of this campaign is that it fits none of the patterns you have trained your people to spot. There is no urgency, no invoice and no link asking for a password. There is a job site the candidate went to on their own, a conversation about working arrangements and language skills, a Zoom call with a face and a voice, and finally a technical exercise that requires a VPN. Our assessment is that the technical exercise is precisely what makes this work. Ask a system administrator to set up WireGuard and it gets done without hesitation, because that is an ordinary working day. If you have people running your systems, you have people trained to install clients and edit configuration files on their own judgement.

The second point is which machine the attack lands on. People look for work outside office hours, often on their own machine. That is the machine that ends up with the scheduled task. CERT-UA recommends that organisations, telecom providers and IT companies in particular, allow work against corporate resources only from managed devices with EDR, correct policies and continuous monitoring, even when the device is privately owned. We think that is the practical answer here, and it is worth saying plainly what the advice costs. Either the personal machine comes under management, or it is kept away from corporate resources entirely. On a managed machine there is an EDR that can see the scheduled task. On an unmanaged one, nobody sees anything at all. If your organisation falls under NIS2, this is one of the points where the risk management requirement turns into a very concrete decision about which devices you let onto your network.

Berigo recommends

• Require that all work against company systems happens from managed devices with EDR and active monitoring, including machines owned by the employee.
• Tell your operations people that recruitment is an attack path, and make it safe to report afterwards. Anyone who has installed something they should not must be able to say so without fearing the consequences.
• Get network clients from the project's own channels or the vendor's own channels. A VPN client that sits on SourceForge because a stranger sent the link is not a client you can use.
• Hunt for what happens after installation. CERT-UA gives a scheduled task under \Microsoft\Windows\ApplicationData\Microsoft on Windows and the file /usr/libexec/timesyncd-check on Linux.
• Block the domains soprasteria-bg[.]com, soprasteriabg[.]com, atlasgroup-ua[.]com and douncloud[.]site, and search your logs back to May 2026.