Full Report
Hackers associated with the Russian threat group Sandworm have been targeting system administrators and IT professionals through fake job offers since at least May. [...]
Analysis Summary
# Threat Actor: Sandworm (APT44 / UAC-0145)
## Attribution & Identity
- **Actor Name:** Sandworm
- **Aliases:** APT44, UAC-0145 (sub-cluster), Voodoo Bear, FrozenBarents, Seashell Blizzard.
- **Affiliation:** Russian Federation (GRY/Main Intelligence Directorate).
- **Sub-group Focus:** This specific campaign is attributed to **UAC-0145**, a specialized sub-cluster of Sandworm.
## Activity Summary
Since at least May 2026, UAC-0145 has been conducting a sophisticated social engineering campaign targeting IT professionals. The operation involves:
1. Identifying targets via resumes on job recruitment sites.
2. Impersonating recruiters from legitimate firms (e.g., Sopra Steria).
3. Conducting "technical interviews" via Telegram and Zoom in English.
4. Tricking candidates into installing trojanized VPN software under the guise of a technical assessment.
## Tactics, Techniques & Procedures
- **Social Engineering:** Impersonation of HR/recruiters; use of Telegram/Zoom for rapport building.
- **Spearphishing:** Use of look-alike domains (e.g., *soprasteria-bg[.]com*) to send instructions.
- **Trojanization:** Modifying legitimate open-source software (WireGuard) to include malicious "SymmetricKey" configuration options.
- **Persistence:** Creation of scheduled tasks on Windows to maintain access.
- **Obfuscation/Evasion:**
- Custom Base64 alphabet replacement to prevent standard decoding and analysis.
- Hosting malicious installers on reputable platforms like **SourceForge** to bypass reputation filters.
- **Cross-Platform Targeting:** Payloads developed for both Windows (PowerShell) and Linux (cURL-based retrieval).
## Targeting
- **Sectors:** IT Services, Telecommunications, System Administration.
- **Geography:** Primarily Ukraine; international focus implied by English-language interviews and Bulgarian branch impersonation.
- **Victims:** Individual IT professionals, system administrators, and employees of telecommunications providers.
## Tools & Infrastructure
- **Malware:**
- **SopraVPN:** A trojanized WireGuard VPN client.
- Malicious PowerShell scripts (Windows).
- Custom Linux executables.
- **Infrastructure:**
- **SourceForge:** Used for hosting trojanized installers.
- **Telegram/Zoom:** Used for initial contact and social engineering.
- **Domains:** soprasteria-bg[.]com (defanged).
## Implications
This campaign represents a shift toward highly personalized, long-con social engineering. By targeting the "keys to the kingdom" held by IT administrators, Sandworm aims to gain initial access to corporate networks through personal devices or secondary workstations used for "test tasks." The use of custom encryption (modified Base64) suggests a high level of effort to evade automated detection systems.
## Mitigations
- **Access Control:** Restrict access to corporate resources (VPNs, Cloud environments) strictly to managed and monitored devices.
- **EDR/XDR:** Ensure Endpoint Detection and Response tools are active on all devices, including those used by remote staff or during onboarding.
- **Personnel Awareness:** Educate IT staff on "Technical Interview" scams; emphasize that legitimate firms rarely require the installation of custom/proprietary VPN software for a basic coding test.
- **Software Integrity:** Verify the hashes of any software provided by third parties, even if hosted on legitimate sites like SourceForge.
- **Network Monitoring:** Monitor for unusual outbound cURL requests or new scheduled tasks originating from VPN-related processes.