Sandworm Uses Fake Job Interviews to Distribute Trojanized WireGuard VPN

Key Takeaways

• The Sandworm APT group is actively exploiting fake job interviews to distribute trojanized WireGuard VPN clients.
• The campaign targets IT professionals, including system administrators, by mimicking legitimate recruitment processes.
• Attackers use convincing social engineering, including video calls and technical assessments, to trick victims into installing malicious software.
• The compromised VPN clients (dubbed “SopraVPN”) are modified WireGuard builds that enable remote code execution and payload delivery on both Windows and Linux systems.
• Organizations and IT professionals should exercise extreme caution with unsolicited job offers and verify software sources independently.

Sandworm Leverages Fake Job Interviews to Distribute Trojanized WireGuard VPN

The notorious Sandworm advanced persistent threat (APT) group has devised a sophisticated new attack vector, transforming the conventional job interview process into a conduit for compromising IT professionals. This multi-stage campaign employs elaborate social engineering tactics, including mock recruiter conversations, live video calls, and a booby-trapped virtual private network (VPN) client, to gain access to individuals who often hold elevated privileges within corporate networks.

Targeting IT Specialists Through Deceptive Recruitment

The operation specifically targets system administrators and other IT specialists, with attackers meticulously reviewing resumes found on popular job-search platforms. The initial engagement typically begins with an unsolicited message from a purported employer, transitioning into chat-based interactions, and culminating in a technical assessment that seemingly necessitates a connection to a corporate VPN.

CERT-UA said in a report that their analysts have attributed this activity to UAC-0145, a subgroup associated with Sandworm, also known as APT44 or Seashell Blizzard. The agency indicated that this campaign has been operational since at least May 2026, highlighting the effectiveness of staged recruitment fraud in circumventing typical technical suspicions. This campaign is particularly concerning due to its focus on individuals responsible for network maintenance and remote access, where the pressure of a credible interview can lead to hasty software installations.

The Sophisticated Sandworm Fake Job Interview Lure

The attackers initiate contact by impersonating legitimate IT employers. Early communications are facilitated through job-site chat platforms and Telegram. These exchanges are followed by a seemingly standard English-language screening and a Zoom video conference, which appears to involve a real human recruiter. This patient and convincing approach mirrors other fake job interview threats, where familiar hiring steps lull candidates into a false sense of security.

Subsequently, candidates receive technical interview instructions via email, which include WireGuard configuration files for either Linux or Windows. These files are presented as essential for completing a test task on the “corporate network.” When the initial connection invariably fails, the interviewer then suggests downloading a custom VPN client, named “SopraVPN,” from a project page linked on the fake company’s website.

This redirection is the core of the attack. The “SopraVPN” application is a modified version based on the legitimate WireGuard source code. As previous incidents involving poisoned VPN apps have demonstrated, a functional client does not guarantee its safety.

CERT-UA’s analysis revealed that the modified client incorporates an additional configuration setting, “SymmetricKey.” This setting, combined with the configuration’s private key, is used to decrypt embedded PowerShell code. On Windows systems, this code then establishes a scheduled task and proceeds to download further payloads from the internet. For Linux targets, the variant utilizes curl to retrieve another executable from attacker-controlled infrastructure, leveraging the VPN’s configuration for the DNS server address. The altered software also introduces changes to the standard Base64 key decoding process.

What You Should Do

• Verify All Job Offers: Independently verify the legitimacy of any recruiting contact through official company channels (e.g., corporate website, LinkedIn) before engaging in interviews or installing any software. Do not rely on contact information provided by the recruiter.
• Scrutinize Software Requests: Treat any request to download or install custom VPN clients, altered configurations, or software from external, unverified sources as a critical red flag, especially if it follows a “technical issue” during an interview.
• Isolate Technical Tasks: For IT professionals, conduct any technical assessment tasks requiring code execution or network access within isolated, disposable virtual environments, never on your primary workstation or devices connected to your organization’s network.
• Implement Strict Device Policies: Organizations, particularly telecommunications providers and IT companies, should enforce policies that only permit access to corporate resources from managed devices equipped with endpoint protection, defined security policies, and continuous monitoring. This applies even to personally owned devices used for work.
• Educate Employees: Regularly alert staff about sophisticated social engineering tactics, including recruiter impersonation and malicious job platform schemes. Emphasize that legitimate recruitment processes do not bypass established software acquisition protocols or device controls.
• Establish Reporting Procedures: Create a clear and accessible process for employees to report suspicious recruitment contacts to the security team immediately. This allows for prompt investigation, evidence preservation, and timely warnings to other potential targets.
• Monitor for Anomalies: Security teams should actively monitor for unusual scheduled tasks, PowerShell activity, and new or unauthorized VPN configurations on endpoints.

Indicators of Compromise (IoCs):-

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.