Sandworm-Linked SopraVPN Turns Fake Interviews Into Endpoint Compromise

CERT-UA tracks the activity as UAC-0145, a sub-cluster within Sandworm, which other vendors track under names including APT44 and Seashell Blizzard. The Sandworm WireGuard malware campaign targets system administrators and IT professionals through recruiter impersonation and a trojanized VPN client. CERT-UA tracks the activity as UAC-0145, a sub-cluster associated with Sandworm, APT44, and Seashell Blizzard.

By making malicious software appear necessary for a legitimate assignment, the campaign reinforces the need to treat administrator workstations as high-priority endpoints for prevention and investigation.

The interview is part of the intrusion chain

UAC-0145 builds credibility before delivering malware, using the recruitment process itself as the social-engineering pretext. CERT-UA documented this sequence:

Attackers study résumés on job-search platforms and approach system administrators or IT specialists while posing as an IT company.

• Initial conversations move from job-site messaging to Telegram and then to an English-language Zoom interview.
• Candidates receive technical assignments and WireGuard configuration files for a supposed corporate VPN.
• In one case, the attackers impersonated Sopra Steria’s Bulgarian operation.
• VPN connection errors then prompt the attacker to recommend SopraVPN, a modified WireGuard client.
• The attackers host SopraVPN on SourceForge and link to it from a look-alike Sopra Steria website.

The lure works because the malicious software appears connected to a legitimate technical assignment. For IT administrator targeting, organizations should treat unexpected VPN clients and recruiter-provided software as higher-risk activity on privileged endpoints.

SopraVPN turns configuration into code execution

SopraVPN is a modified client compiled from WireGuard source code. CERT-UA found several changes that turn attacker-supplied VPN configuration into an execution mechanism:

• The client adds a nonstandard SymmetricKey configuration option.
• Its value contains Base64-encoded nonce, ciphertext, and authentication-tag data.
• The client decrypts that payload using AES-256-GCM, with the decoded PrivateKey value serving as the 32-byte key.
• After decryption, it passes the resulting PowerShell code to WireGuard’s existing runScriptCommand mechanism.
• PrivateKey and PublicKey use a custom Base64 alphabet generated with a Fisher-Yates shuffle seeded from a CRC32 value calculated from SymmetricKey.

This behavior belongs to the trojanized VPN client, not legitimate WireGuard. Defenders should focus on the modified software, suspicious configuration, and resulting execution activity rather than treat normal WireGuard use as an indicator.

Windows persistence follows the VPN connection

After SopraVPN processes its malicious configuration on Windows, PowerShell creates a scheduled task and downloads an additional payload. The scheduled task gives defenders a concrete scheduled task persistence indicator to investigate.

*Priorities are editorial investigation priorities, not CERT-UA severity ratings.

Teams should correlate these artifacts rather than treat generic VPN activity alone as evidence of compromise.

Administrator endpoints deserve a stricter trust boundary

This Sandworm WireGuard Malware campaign highlights a key endpoint security risk: attackers can exploit legitimate-looking tools and workflows to reach privileged users. Organizations should apply tighter controls to administrator workstations:

• Maintain approved software baselines for VPN and remote-access tools.
• Investigate networking clients installed outside standard deployment channels.
• Keep administrator endpoints managed and continuously monitored.
• Verify recruiter-provided executables and configuration files before use.
• Correlate unexpected software installation with PowerShell, scheduled-task, process, and network activity.

CERT-UA recommends allowing access to corporate resources only from managed devices with EDR, appropriate policies, and continuous monitoring—even for personally owned devices.

For this campaign, controlling the administrator endpoint provides more durable protection than blocking a single filename.

Featured resource

Introduction to Hexnode XDR

Strengthen enterprise security with Hexnode XDR’s unified visibility, investigation, correlation, and automated response capabilities.

DOWNLOAD

Where Hexnode fits into the response workflow

Hexnode can support application control, threat investigation, and endpoint containment on managed Windows endpoints.

Hexnode UEM

• Use Application Compliance to identify Windows devices with blocklisted apps or software outside a configured allowlist.
• Apply separate Blocklist/Allowlist policies to restrict unapproved applications.
• Configure approved Windows VPN profiles through Hexnode UEM.
• Maintain visibility into software installed on managed administrator endpoints.

These controls can identify blocklisted applications or software outside a configured allowlist, but does not specifically identify SopraVPN as malware.

Hexnode XDR

• Investigate suspicious process and endpoint activity.
• Kill malicious processes.
• Quarantine malicious files.
• Isolate affected endpoints.

For this campaign, Hexnode XDR can help investigate suspicious endpoint and process activity. However, it does not establish a specific detection for UAC-0145, SopraVPN, or the modified WireGuard client.

The real control point is the administrator workstation

The Sandworm WireGuard malware campaign disguises malicious activity as legitimate technical work. Attackers use a VPN assignment and connection problems to steer targets toward the trojanized SopraVPN client.

Enterprises should treat administrator endpoints as privileged assets. Managed software baselines, continuous monitoring, controlled VPN deployment, and rapid investigation can reduce exposure to this type of attack.