Ukraine: a fake recruiter, a fake interview, a poisoned VPN
Someone reads your CV on a job site, contacts you about a role, moves the conversation to Telegram, interviews you over video in English, and sends you a technical test. The test needs you to connect to a company network. The connection fails, so they helpfully offer you their own software instead.
Ukraine's national cyber team says the recruiters are Russian military intelligence, and that the software quietly runs whatever commands they choose. The people being approached are system administrators - the ones who hold the keys to everyone else's network.
↓ Download one-page brief (PDF)They read your CV first
The operators search legitimate Ukrainian job sites, review the CVs of system administrators and IT specialists, and make direct contact through the site's own chat. The approach is targeted at the individual, not sprayed at a list, which is why it does not read like spam.
The conversation moves to Telegram
A person presenting as a recruiter for an IT company - in one case a firm called ATLAS Business Group - moves the conversation off the job platform and onto Telegram, where there is no employer, no moderation and no record on the site.
A video interview, in English
A Zoom interview follows, conducted in English, in which the supposed recruiter discusses the role and the candidate's language ability. Several days of ordinary-looking process have now passed, which is what makes the next step reasonable.
The technical test that cannot work
The candidate is emailed assignment instructions from addresses imitating the regional offices of a genuine international IT firm, together with configuration files to connect to a corporate network for the assessment, and a second interview link at which the test will be watched. The configuration is designed to fail.
The helpful solution
When the connection errors, the recruiter suggests a custom client instead - "SopraVPN", hosted on SourceForge, with a link to a website themed on the real firm's Bulgarian office. It is built from genuine WireGuard code with one addition: a non-standard setting inside the configuration file that decrypts and runs concealed commands. On Windows it schedules a task and fetches a further payload; on Linux it pulls one down through the VPN itself.
WireGuard, and why using it is clever
WireGuard is a widely used, well-regarded open-source system for encrypted network connections. Building on it means the software behaves like the real thing, because most of it is the real thing. WireGuard itself was not compromised; a copy of its public code was modified.
The instructions are in the settings, not the program
The concealed commands are encrypted inside the VPN configuration file, reached through a non-standard option. Inspecting the program finds a VPN client, because that is what it is. The harmful part arrives as configuration, which is not where most inspection looks.
A platform your security tools already trust
SourceForge is a long-established site for distributing open-source software. Traffic to it is routinely permitted and rarely treated as suspicious, so the download does not stand out on a corporate network.
The same actor, a different disguise
CERT-UA attributed a campaign using fake security check-boxes on compromised websites to the same cluster in July. The targeting is consistent and the packaging keeps changing, which is the pattern to plan against.
Nothing in this operation was hacked. A real job site, a real messenger, a real video platform, a real company's name, a real code repository and a real VPN protocol were assembled into something that behaves exactly like a legitimate hiring process, right up to the moment the candidate installs the software. The trust being exploited is not technical; it is the ordinary trust of somebody applying for a job.
The target is the administrator because the objective is everyone they administer
This campaign does not go after executives or classified material. It goes after the people with privileged access to networks - and it reaches them in the one situation where they are predisposed to be helpful, responsive and willing to install unfamiliar software: a job application. Recruitment is the moment a technical worker's normal scepticism is working against them, because refusing looks like failing the test.
A multi-day process defeats a single-moment defence
Awareness training teaches people to be suspicious of an unexpected message. Here the malicious step arrives after days of ordinary interaction - a real job advert, a real chat, a video interview, a written assignment. By the time the software is offered, the relationship is established and the request is in context. Nothing in a conventional phishing test resembles this.
The deliberate failure is the cleverest part of the tradecraft
The first configuration file is built not to work. That single decision converts the attacker from someone asking the victim to install software into someone helping the victim solve a problem. The victim ends up wanting the malicious client, and may well raise the idea of an alternative themselves.
Legitimate platforms are being used as infrastructure, and blocking them is not available
A real job site, Telegram, Zoom, SourceForge and a real company's name. None was compromised and none can realistically be blocked by a defender. This is the same pattern as Kimsuky's use of code repositories to carry attacker instructions. The defensive answer has to be behavioural - what the software does once it runs - because the source will keep looking legitimate.
The campaign will continue and the packaging will change again
The same cluster used fake security check-boxes in July and a fake hiring process in August, against the same class of target. It is highly likely that recruitment-themed social engineering against technical staff continues, and likely that the next iteration uses a different trusted platform and a different convincing reason to install something.
Set this beside the Donaustahl plot, where a defence executive was reconnoitred by people recruited online and paid modestly. Both operations reach a high-value target through an ordinary interaction with an ordinary person. One used a job offer to reach a network; the other used casual labour to reach a man. Neither needed a trained officer anywhere near the target.
- Warn technical staff specifically, and not as part of general phishing training. System administrators are being targeted through job applications. That is a personal risk to them and an organisational risk to you, and it will not be covered by an exercise about invoices.
- Never install software supplied by a prospective employer on a machine that matters. A technical assessment that requires an unfamiliar client is a red flag on its own. If a test must be done, it should be on a clean personal device with nothing else on it.
- Treat a failing connection followed by a helpful alternative as the warning sign. The deliberate error is the hinge of this attack. Any process where something breaks and the other party immediately offers their own tool deserves to stop there.
- Verify a recruiter through the company, not through the recruiter. Look up the firm independently and contact it through its published details. Email addresses imitating a real company's regional offices are trivial to create and were used here.
- Ask what your security tools do with trusted platforms. If downloads from well-known code repositories are permitted without inspection, that is a decision worth revisiting rather than a default worth keeping.
- Watch what software does, not where it came from. A scheduled task created after an install, an unexpected outbound connection, a script fetching a second file - these are visible regardless of how legitimate the download looked.
- Give staff a way to report a suspicious approach without embarrassment. Somebody part-way through a fake interview process needs to be able to raise it without feeling foolish, and quickly, because the useful window is before the install.
- https://thehackernews.com/2026/08/sandworm-linked-uac-0145-uses-fake-job.html
- https://therecord.media/russian-military-hackers-pose-as-recruiters-ukraine-it-workers
- https://www.bleepingcomputer.com/news/security/sandworm-hackers-target-it-pros-with-trojanized-wireguard-vpn-client/
- https://cyberpress.org/sandworm-targets-it-professionals/
Compiled from open-source reporting for professional security discussion. The attribution of this campaign to UAC-0145, to Sandworm and to Russia's GRU is that of Ukraine's Computer Emergency Response Team, a national authority and a party to the conflict; it has not been independently confirmed. CERT-UA has not disclosed how many people were targeted, how many were compromised, or what the operators were ultimately seeking. The organisations impersonated in this campaign - the job platforms, the messaging and video services, the software distribution site and the IT companies whose names were used - were not compromised and are not implicated. Technical indicators are not reproduced here. Details may be revised. This is a protective-security lessons-learned assessment, not an operational account.