Sandworm Targets IT Admins with Trojanized WireGuard VPN Client

Russian state-sponsored actors associated with Sandworm are targeting system administrators and IT professionals through an elaborate social engineering scheme involving fake job interviews. Detailed by the Computer Emergency Response Team of Ukraine (CERT-UA), the activity cluster tracked as UAC-0145—a sub-group of Sandworm (APT44)—distributes a trojanized WireGuard VPN client disguised as a corporate onboarding tool. Active since at least May, the campaign leverages spoofed corporate identities and technical recruitment tests to compromise high-privilege IT personal and enterprise endpoints.

APT44 Exploits Recruitment Workflows to Target Admins

Sandworm has a long-standing reputation as one of Russia’s most aggressive cyber-espionage and sabotage units. Operating under the main center of the Russian General Staff’s Main Intelligence Directorate (GRU), the group is historically known for destructive attacks against Ukrainian critical infrastructure, supply chain compromises, and global credential-harvesting operations. In this campaign, APT44 shifts focus toward human-targeted credential access and initial entry via personal and unmanaged assets.

Targeting system administrators provides an efficient shortcut into secure environments. IT personnel frequently possess elevated credentials, SSH keys, network access, and direct visibility into sensitive administrative tooling. By targeting individuals during job searches, attackers exploit a scenario where candidates expect to download unfamiliar software, run technical assessments, and establish remote connections to unfamiliar infrastructure—bypassing typical security skepticism.

Anatomy of the Trojanized WireGuard VPN Attack

The UAC-0145 operators begin by monitoring popular job portals and resume databases to identify system administrators and network engineers. Once a target is selected, attackers initiate contact while impersonating legitimate international technology firms. In cases observed by CERT-UA, the threat actor impersonated the European IT services firm Sopra Steria, utilizing domain infrastructure such as soprasteria-bg[.]com designed to mimic the company’s office in Bulgaria.

The interaction progresses through several staged phases:

1. Initial Outreach & Telegram Pivot: Recruiters establish direct contact and quickly pivot conversations to Telegram to schedule a technical evaluation.
2. Video Interview: The candidate attends a live video interview conducted in English via Zoom, enhancing the perceived legitimacy of the recruitment process.
3. The VPN Lure: Following the interview, the candidate receives an email containing instructions for a practical technical test. The email includes WireGuard configuration files meant to connect the candidate to a target “corporate” network.
4. Forced Client Download: When the victim attempts to import the configuration into a standard WireGuard application, the file fails with an intentional configuration error. The attackers direct the target to download a modified client package named “SopraVPN” hosted on SourceForge.

Technical Analysis of the Trojanized WireGuard Client

The malicious binary is a modified build of the open-source WireGuard client. To maintain the illusion of legitimacy, the attackers linked the SourceForge hosting page directly to soprasteria-bg[.]com.

Under the hood, the modified client introduces custom configuration directives and obfuscation mechanisms designed to execute arbitrary code while evading endpoint detection and static analysis tools:

• Custom Config Directive: The altered client implements a non-standard SymmetricKey option within the WireGuard configuration file. When parsed by the executable, this directive triggers the decryption and execution of embedded code.
• Custom Base64 Alphabet: Standard WireGuard builds rely on standard Base64 encoding. The attackers replaced this with a dynamically generated custom Base64 alphabet. This modification breaks standard automated decoders and prevents static analysis tools from identifying strings and embedded PowerShell scripts.
• Windows Payload Execution: On Windows systems, parsing the SymmetricKey parameter executes PowerShell commands that establish persistence via Scheduled Tasks and pull secondary malware payloads from attacker-controlled infrastructure.
• Linux Payload Execution: On Linux endpoints, the altered client executes shell commands using cURL to retrieve and execute secondary binaries over the established VPN tunnel.

Impact and Organizational Blast Radius

Because IT professionals frequently perform work-related tasks from personal devices, home labs, or dual-use laptops, this campaign exposes enterprises to significant lateral movement risks. A successful compromise places malware directly onto an administrator’s endpoint, providing attackers access to cached VPN credentials, SSH config files, saved password vault tokens, and administrative session cookies.

If an affected administrator uses an unmanaged personal device to access production corporate networks—or connects via a personal VPN jumpbox—APT44 can hijack those active credentials or establish direct persistent access into managed corporate environments.

Defensive Mitigations and Detection

Organizations, particularly telecommunications providers and technology vendors operating in or supporting European and Ukrainian infrastructure, should enforce strict access controls on administrative interfaces:

• Enforce Managed Device Requirements: Restrict all corporate remote access, SSH gateways, and corporate VPNs strictly to compliant, corporate-managed devices protected by Endpoint Detection and Response (EDR) solutions. Unmanaged BYOD personal equipment must be blocked from corporate resource access regardless of valid credentials.
• Inspect SourceForge Downloads and Custom VPN Clients: Monitor network telemetry for unauthorized VPN installers and traffic reaching soprasteria-bg[.]com or suspicious SourceForge repositories hosting custom WireGuard forks.
• Detection for Non-Standard WireGuard Configurations: Threat hunting teams should audit WireGuard config files on endpoints for non-standard parameters like SymmetricKey and inspect process lineages where WireGuard launches powershell.exe, cmd.exe, or curl.