Sandworm Hackers Impersonate IT Recruiters to Target Ukrainian Admins

Russian military intelligence hackers associated with Sandworm are currently running a targeted social engineering campaign against Ukrainian IT professionals, specifically targeting system administrators who hold elevated access to internal networks. According to Ukraine’s Computer Emergency Response Team (CERT-UA), the activity has been active since at least May and relies on fake recruitment pipelines designed to trick job candidates into installing a trojanized WireGuard client named “SopraVPN”.

By targeting individual administrators on popular employment platforms rather than probing hardened perimeter defenses, the threat actors gain a high-trust initial access channel directly onto endpoints connected to administrative and enterprise networks.

The Multi-Stage Recruitment Lure

The campaign relies on a detailed, multi-step recruitment process to establish credibility before introducing malicious software. The operational workflow unfolds across several distinct phases:

1. Target Identification: The attackers browse legitimate Ukrainian job portals for candidates listing expertise in system administration, network engineering, and core IT operations.
2. Initial Contact & Screening: Posing as recruiters from a fake entity named “Atlas Business Group”, the hackers initiate contact through the job portal’s built-in chat system. They claim to be hiring technical talent for a project involving Sopra Steria Bulgaria, a legitimate branch of the European IT services firm Sopra Steria.
3. Platform Pivot: The conversation is shifted to Telegram, where a persona acting as an HR manager conducts standard screening regarding work arrangements, compensation, and English proficiency.
4. Live Interview: Candidates are invited to a Zoom video interview hosted by an English-speaking man (estimated to be between 30 and 35 years old). CERT-UA has not confirmed whether this interviewer is a live member of the hacking unit or an AI-generated deepfake persona.
5. Technical Evaluation: Following the interview, candidates receive a follow-up email instructing them to complete a practical technical test. The email address used by the attackers is carefully domain-spoofed to match legitimate regional offices of Sopra Steria.

Trojanized VPN Mechanics and Delivery

To complete the fake technical assignment, candidates are asked to establish a remote connection to a mock corporate environment using WireGuard, a popular open-source VPN protocol. When the candidate attempts to connect using legitimate configuration files, the connection intentionally fails with an error.

The fake recruiter then directs the candidate to download a custom client called “SopraVPN” to bypass the error. The software is hosted on SourceForge and linked through a typosquatted domain designed to mirror Sopra Steria’s official web presence.

The attack relies on software trojanization rather than a zero-day vulnerability:

• Source Modification: The threat actors modified the legitimate open-source WireGuard codebase to include covert command-execution routines.
• Payload Hiding: To minimize static signature detection, the malicious commands executed by SopraVPN are encrypted and embedded directly within the VPN configuration files (.conf) supplied to the victim.
• Execution: Once SopraVPN is launched and processes the configuration file, the application decrypts and runs arbitrary commands on the target machine in the background while displaying a standard VPN interface to the user.

Sandworm Threat Context and Blast Radius

Sandworm—also tracked as APT44 and Seashell Blizzard—is operated by Unit 74455 of Russia’s GRU military intelligence agency. Historically known for high-impact destructive cyber operations, including the BlackEnergy and Industroyer attacks against Ukrainian electrical substations and the global NotPetya outbreak, the group frequently adapts its initial access methods to bypass modern endpoint defenses.

While recruitment lures have long been a signature tactic of North Korean state actors (such as the “Operation Dream Job” campaigns) and Chinese espionage groups, Sandworm’s adoption of this technique highlights a growing reliance on personal-device and work-from-home vectors to penetrate Ukrainian infrastructure.

The blast radius for this campaign depends heavily on the candidate’s environment:

• Workstation Compromise: Installing SopraVPN on a corporate or administrative workstation immediately exposes stored credentials, active SSH keys, browser session cookies, and local network routes to the attackers.
• Privilege Escalation & Lateral Movement: Because system administrators routinely maintain broad access across enterprise domain environments, active directory infrastructure, and cloud management consoles, a successful compromise of a single administrator’s machine frequently yields full network compromise.
• Supply Chain Exposure: If an administrator manages third-party infrastructure or managed service provider (MSP) accounts, Sandworm can pivot laterally into customer networks, facilitating wiper deployment or persistent espionage.

Defensive Guidance and Indicators

Organizations employing technical staff, particularly those based in or operating within Ukraine, should take specific defensive steps:

• Endpoint Software Whitelisting: Enforce strict Application Control / AppLocker policies that prevent end users from executing non-standard software binaries or custom VPN packages downloaded outside managed corporate repositories.
• Inspect WireGuard Configurations: Hunt across endpoints for non-standard builds of WireGuard executables and inspect .conf files for unusual binary blobs, base64-encoded strings, or encrypted command structures.
• Interview Isolation Guidelines: Explicitly instruct IT personnel and administrative staff never to run technical testing tools, VPN clients, or executable scripts provided during job recruitment processes on devices connected to corporate networks. All candidate evaluations involving live testing should occur on isolated, non-persistent virtual machines or dedicated lab environments.
• Domain Blocking: Ensure network edge devices and DNS resolvers block lookalike domains referencing Sopra Steria, Atlas Business Group, or suspicious SourceForge distribution links associated with untrusted VPN software builds.