Loading story…
CERT-UA warned that a Sandworm-linked cluster, UAC-0145, has been impersonating recruiters and IT companies on legitimate job platforms to target Ukrainian IT professionals, particularly system administrators and other technical staff. The attackers reportedly review resumes, move conversations from job-site chat to Telegram and Zoom, and guide candidates through a fake hiring process that includes a supposed technical assessment. As part of that process, victims receive WireGuard VPN configuration files; when the connection predictably fails, they are told to install a trojanized VPN client called SopraVPN from SourceForge and a spoofed website themed to resemble Sopra Steria Bulgaria.
CERT-UA said the malicious client was built from legitimate open-source WireGuard code but altered to decrypt and execute hidden payloads embedded in VPN configuration values through a custom SymmetricKey option, using AES-256-GCM and a shuffled Base64 alphabet. On Windows, the malware uses PowerShell and a scheduled task to fetch additional payloads from the internet, while on Linux it uses curl to retrieve an executable through attacker-controlled VPN infrastructure. The activity has been ongoing since at least May 2026, and CERT-UA urged organizations—especially telecom operators and IT companies—to limit corporate access to managed devices protected by EDR and continuous monitoring.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CERT-UA publicly reported the campaign, attributed it to UAC-0145 as a Sandworm-linked cluster, and described how the modified WireGuard client decrypted and executed hidden payloads on Windows and Linux. The advisory also published file and network indicators and urged organizations to restrict corporate access to managed devices with EDR and continuous monitoring.
CERT-UA said threat cluster UAC-0145, a subcluster of UAC-0002/Sandworm, has been running a social-engineering campaign against Ukrainian IT workers and job seekers. The operation targeted system administrators and other IT specialists through legitimate job platforms and fake recruiter interactions.
As part of the campaign, attackers impersonated recruiters and HR staff, moved conversations to Telegram and Zoom, then sent WireGuard configuration files for a supposed technical test. When those files failed, victims were directed to install a malicious WireGuard-based client called SopraVPN from SourceForge via a spoofed Sopra Steria-themed website.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
news.risky.biz
Open sourcebleepingcomputer.com
Open sourcetrojan-killer.net
Open sourcetherecord.media
Open sourcecert.gov.ua
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CERT-UA reported that the Russia-linked **Sandworm** cluster `UAC-0145`, tied to `UAC-0002` and also tracked as **APT44** and **Seashell Blizzard**, has run a sustained campaign against Ukrainian targets using several social-engineering and malware-delivery methods. Investigators said attackers compromised more than 10 websites and deployed **ClickFix**-style fake CAPTCHA pages that instructed visitors to paste malicious PowerShell commands into Windows, while other lures included trojanized software installers from torrent trackers, bogus antivirus installation requests sent through Signal, and a fake Android security app. CERT-UA linked the activity to long-running operations targeting Ukrainian government and military-related organizations. The campaign used a broad malware ecosystem including **GHETTOVIBE**, **SCOUTCURL**, **FLUIDLEECH**, **LOADLOOP**, **FREAKYPOLL**, **SMARTAXE**, and the Android backdoor **COWARDDUCK**, alongside legitimate tools such as **OpenSSH**, **Tor**, and **rsync** for persistence, tunneling, and exfiltration. CERT-UA said at least one infection delivered through a trojanized installer enabled persistence and lateral movement inside an organization and was later used in a destructive attack against the infrastructure of a central executive authority of Ukraine. Analysts also found the operators using **Cloaking.House** and blockchain `eth_call` lookups to retrieve remote domains dynamically, while the Android malware was capable of stealing files, contacts, device data, and real-time geolocation and used the Dropbox API and content from legitimate services in its command-and-control workflow.
Jul 19, 2026
CERT-UA warned that the Russian state-linked Sandworm group has adopted the **ClickFix** social-engineering technique to target Ukrainian organizations, using compromised websites and fake CAPTCHA pages that trick users into copying and pasting malicious PowerShell commands. Those commands reportedly download and execute multiple payloads, including **FreakyPoll**, **GHETTOVIBE**, **SCOUTCURL**, **FluidLeech**, and **LoadLoop**, while Sandworm also used a custom utility called **SMARTAXE** to support the CAPTCHA-hosting infrastructure by querying Ethereum smart contracts for domain lists. CERT-UA said the activity began in spring 2026 and continued through summer, with at least ten sites identified as hosting the malicious lure infrastructure. The campaign reflects a broader surge in **ClickFix** and related copy-and-paste attack variants such as **CrashFix**, **InstallFix**, and **FileFix**, which security researchers say are increasingly used for initial access and malware delivery. Huntress reported a sharp rise in ClickFix incidents, while other documented cases have shown attackers chaining fake browser extensions, obfuscated PowerShell, `finger.exe`, Python-based remote access tools, persistence via Run keys and scheduled tasks, and staged payload downloads. Defenders were urged to look beyond the lure pages and hunt for compromised web servers, web shells, unauthorized CAPTCHA content, suspicious process chains, dropped files, persistence artifacts, and outbound connections tied to follow-on malware activity.
Jul 30, 2026
Russian GRU-linked **Sandworm** has targeted Ukrainian organizations through multiple intrusion paths, including exploitation of vulnerable **Exim Mail Transfer Agent** servers and malware-laced Microsoft **KMS activation tools**. NSA reporting tied GRU operators to active exploitation of Exim for initial access, while newer reporting said Sandworm used trojanized software installers in cyber-espionage campaigns aimed at Ukrainian users, expanding the group’s access beyond perimeter-facing mail infrastructure. Researchers and media reports said the activity affected about **20 critical organizations in Ukraine**, underscoring Sandworm’s continued focus on high-value government and infrastructure targets. The combined reporting shows a sustained campaign that blends server-side exploitation with social engineering and malicious software distribution to establish footholds, steal information, and support disruptive operations associated with the Russian military intelligence apparatus.
Jul 12, 2026