A Three-Month Campaign Built on Trust, Not Exploits
CERT-UA, Ukraine's Computer Emergency Response Team, disclosed this week that a Sandworm-linked unit it tracks as UAC-0145 spent roughly three months — since at least May 2026 — running a recruitment scam against Ukrainian system administrators and IT staff. UAC-0145 is described as a sub-cluster of Sandworm, the GRU military intelligence unit also tracked as APT44 and Seashell Blizzard (The Hacker News). The operation required no software vulnerability at all. Operators combed real job platforms, contacted candidates posing as recruiters for firms including ATLAS Business Group, and impersonated an HR manager supposedly screening for Sopra Steria Bulgaria, a real European consulting firm. Conversations migrated to Telegram and Zoom, culminating in a staged "technical assessment" that required connecting to a corporate VPN (CERT-UA advisory; The Hacker News).
The supplied WireGuard configuration was designed to fail. When it did, victims were directed to a spoofed site mimicking Sopra Steria Bulgaria and told to download a replacement client — "SopraVPN" — hosted on SourceForge for extra legitimacy.
The Payload Was Never in the Binary
What makes SopraVPN notable isn't novelty of intrusion but where the malicious logic hides. The client is compiled from real, open-source WireGuard code, so it largely behaves like a normal VPN. The trojanization sits in a custom "SymmetricKey" configuration field that isn't part of standard WireGuard: it carries AES-256-GCM-encrypted data, decrypted using a key derived from the connection's own PrivateKey, that resolves into PowerShell commands executed through a mechanism tied to WireGuard's legitimate PostUp option. The client also swaps WireGuard's standard Base64 decoding for a shuffled, dynamically generated alphabet, so the config file doesn't even look like it's carrying anything unusual to casual inspection (The Hacker News; BleepingComputer). Because the malicious instructions live in a config value rather than the executable, static-signature and binary-reputation checks — the first line of most endpoint defenses — have little to catch. On Windows, the payload lands via scheduled tasks; on Linux, via cURL calls run through the established VPN tunnel.
This is UAC-0145's second disclosed campaign in as many months. In June and July, CERT-UA and partner researchers tracked the same cluster using fake CAPTCHA prompts ("ClickFix") on at least ten compromised websites, paired with an EtherHiding technique that pulled command-and-control instructions from Ethereum smart contracts to survive takedowns (The Hacker News). The throughline across both campaigns is a deliberate move away from Sandworm's earlier signature — grid-disrupting malware like Industroyer — toward compromising the IT workforce itself, the people who hold the keys to everything else.
The Case for Tighter Mandates — and Why CERT-UA Didn't Reach for One
There's a real argument for a heavier regulatory hand here. A single compromised sysadmin at a telecom or utility can cascade into critical-infrastructure access during an active war, and the sophistication of this lure — a real company name, a real hosting platform, a real protocol — shows social engineering alone can beat security awareness training. A government mandating device certification, VPN allowlisting, or a ban on installing any non-approved network client on corporate-adjacent hardware would not be an unreasonable response to that risk calculus.
CERT-UA didn't go there. Its published guidance is a recommendation, not a directive: restrict corporate resource access to managed, continuously monitored devices protected by EDR — including when staff use personal equipment — hunt for anomalous scheduled tasks and VPN connections, and treat unsolicited recruiter contact ending in a custom software install as a red flag (BleepingComputer). That posture tracks the framework Ukraine set out in its 2021 Cybersecurity Strategy (Decree 447/2021), which names resilience — "the ability to quickly adapt to internal and external threats" — and international cooperation as co-equal pillars alongside deterrence, backed by a national incident-management system rather than blanket compliance rules for industry (National Security and Defense Council of Ukraine).
That model is being funded, not legislated, into readiness. Italy committed €1 million in January 2026 under the Tallinn Mechanism specifically to harden Ternopil-region networks with EDR tooling and to support Ukraine's National Coordination Centre's annual cybersecurity reviews (Cabinet of Ministers of Ukraine) — the same EDR baseline CERT-UA is now telling telecoms and IT firms to adopt in response to SopraVPN. Advisory-plus-capacity-building, rather than top-down device mandates, is what's actually building the defense CERT-UA is asking for.
Proportionate Doesn't Mean Passive
The United States is experimenting with a different model for a different threat class: an August 10 presidential memorandum lets vetted private cyber firms conduct DOJ/DHS-supervised offensive operations against transnational cybercriminal groups (The Record). That's a public-private offense model against criminal actors; Ukraine's is a public-disclosure defense model against a state adversary. Both reflect the same underlying judgment worth defending: the fastest way to blunt a fast-moving threat is to mobilize the private sector's capability and information, not to centralize every decision in a single regulator. CERT-UA's real achievement here isn't stopping UAC-0145 — Sandworm will iterate again — it's publishing the technical detail fast enough, and specifically enough, that any sysadmin who reads it now knows exactly what a fake job offer that ends in "install this VPN" looks like.