Fake Corporate VPN Test Creates Scheduled Task and Downloads Malware on Windows

Gbhackers •Mayura Kathir • August 12, 2026

An advanced recruitment-themed intrusion campaign attributed to UAC-0145, a cluster that includes subcluster UAC-0002, also tracked as Sandworm, APT44 and Seashell Blizzard. The activity, observed since at least May 2026, begins on job- platforms. Operators review a candidate’s résumé, the individual while impersonating an IT company such as ATLAS Business Group, and move the […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Sandworm Hackers Use Fake Job Interviews to Deploy Trojanized VPN Client The Russian threat group Sandworm has been targeting IT professionals through a social engineering campaign since May 2026. The campaign, attributed to the UAC-0145 subgroup, involves impersonating IT companies and recruiters to lure victims into downloading a trojanized WireGuard VPN client. Victims are approached via fake job offers, and conversations are moved to Telegram for video interviews. During these interviews, candidates receive technical assignments requiring VPN access, leading them to download a malicious client called 'SopraVPN.' This client is designed to execute embedded PowerShell code and can create scheduled tasks on Windows or retrieve executables on Linux. CERT-UA has advised IT companies to restrict access to corporate resources to managed devices. The campaign highlights the ongoing threat to critical infrastructure and government entities, particularly in Ukraine. 7 sources 77

Extracted Entities

Fake Corporate VPN Test Creates Scheduled Task and Downloads Malware on Windows

The full story

Extracted Entities

APT Groups (3)

Attack Types (1)

MITRE ATT&CK (1)

Platforms (1)