Ukraine’s Computer Emergency Response Team (CERT-UA) has warned of a new campaign linked to the UAC-0145 threat cluster, specifically subcluster UAC-0002, also known as Sandworm, APT44, or Seashell Blizzard. The campaign uses job offers and fake recruitment processes to target system administrators and other IT professionals.
Attackers first contact candidates through job-search platforms after reviewing their resumes. The conversation is then moved to Telegram, where a fake HR representative discusses the position, conducts a basic interview, and provides a Zoom meeting link. The attackers reportedly use English and hold real video calls to make the recruitment process appear legitimate.
The attack begins when victims receive technical interview instructions by email. Candidates are asked to connect to a supposed corporate VPN using WireGuard configuration files. The emails use spoofed infrastructure, including a domain disguised as the Bulgarian operation of IT company Sopra Steria.
When the provided VPN configuration fails, victims are instructed to install a modified VPN client called “SopraVPN.” The malicious software is based on WireGuard source code but contains additional functionality designed to execute hidden PowerShell commands.
The modified client supports a non-standard SymmetricKey configuration option. Its value contains Base64-encoded AES-256-GCM data, including a nonce, ciphertext, and authentication tag. The AES-256 key is derived from the decoded PrivateKey. After decryption, the resulting PowerShell code is passed to WireGuard’s runScriptCommand mechanism, which can execute commands specified through options such as PostUp.
The attackers also modified the Base64 decoding process. The PrivateKey and PublicKey values use a custom 64-character alphabet generated by shuffling the standard Base64 alphabet with the Fisher-Yates algorithm. The CRC32 value of SymmetricKey is used as the seed for the pseudo-random number generator that determines the shuffle.
The payload delivery differs between operating systems. On Windows, the PowerShell code creates a scheduled task and downloads an additional payload from the Internet. On Linux, the modified VPN client uses curl to download an executable from infrastructure controlled by the attackers through the VPN connection.
CERT-UA said the activity has been observed since at least May 2026.
Separately, Poland’s CERT disclosed that the destructive December 2025 cyberattack attributed to Russia's FSB Center 16 targeted two power plants, including a previously unreported facility. Hackers disrupted industrial control systems managing a steam turbine and water treatment, but staff restored them before services were affected. Authorities found the attackers gained access through a FortiGate device at a wind farm, compromised a router, and moved into the plant through a mobile APN connection.
Meanwhile, New Zealand has imposed new sanctions against Russian hackers and people involved in online disinformation. The sanctions target members of the RaHDit and Cyber Army of Russia Reborn hacktivist groups, individuals and organizations spreading disinformation, and the director of a cloud provider MediaLand linked to Russian hacking and fake news websites.