Cyber crooks are getting creative with their scams. Ukraine’s Computer Emergency Response Team (CERT-UA) has warned about a new trick used by hackers tied to Russia’s Sandworm group.
The attackers pose as recruiters and job interviewers. Their real goal is to plant a fake VPN app on a victim’s computer. That app can then run secret commands and pull in more harmful software.
How the fake job scam works
The hacking cluster behind this scam is called UAC-0145. Researchers say it is a smaller part of the larger Sandworm group, which also goes by names like APT44 and Seashell Blizzard. CERT-UA links the group to Russia’s military intelligence service. The scam has reportedly been running since May 2026.
Ukrainian authorities are also active on other cybercrime fronts; police recently arrested three individuals for hacking over 610,000 Roblox accounts, demonstrating the country’s ongoing efforts to combat cybercrime across multiple fronts.
The attackers do not send random phishing emails. Instead, they hunt for targets on job search sites. They read through resumes first. Then they reach out to system admins and other tech workers directly. Some attackers claim to represent real IT firms, including one called ATLAS Business Group.
At first, the chat happens right on the job site. Soon after, the conversation moves to Telegram. A fake HR staff member then chats with the candidate there. This person asks about the job, work hours, and English skills. The scam feels real because a live person often joins a Zoom interview too, and that person speaks fluent English.
Once trust is built, the fake interviewer asks the candidate to complete a technical task. The task involves connecting to what looks like a company VPN. Candidates receive WireGuard configuration files for this step.
Why the trick works so well
The connection is designed to fail from the very start. When the error pops up, the fake recruiter jumps in with a fix. They tell the victim to download a special VPN program called SopraVPN. The link points to SourceForge, a well-known software hosting site. Because SourceForge is a trusted site, most security tools do not flag the download as risky.
To add more shine to the scam, attackers built a fake website too. The site is styled to look like it belongs to Sopra Steria Bulgaria, a real European tech company. CERT-UA explained that the attackers built their VPN client from real, open-source WireGuard code, then quietly altered it to hide harmful features inside.
The changed program adds a strange setting called “SymmetricKey.” This setting is not part of normal WireGuard software. Inside it, hackers hide scrambled commands. The data gets protected with AES-256-GCM encryption and a modified type of Base64 code. This scrambling helps the hidden commands slip past security scans unnoticed.
Once the key unlocks, bad things start to happen. On Windows machines, the tool can create a scheduled task and quietly grab more harmful files from the internet. On Linux machines, the tool uses a command called curl to pull down and run a second harmful file. In short, a tool that looks like a normal VPN turns into a doorway for deeper attacks.
How to stay safe from this scam
CERT-UA has urged IT workers to treat unusual software requests during interviews with real caution. According to the agency, job seekers should question any offer that asks them to install unknown software or use setup files from a source they cannot verify. The agency also advises checking a company’s identity through an outside channel, not just the one the recruiter offers.
Businesses can also take steps to guard their teams. Security experts suggest blocking company system access from personal or unmanaged devices. IT teams should also watch computers for strange scheduled tasks, odd command-line activity, and unusual PowerShell use.
If someone believes they already installed SopraVPN, quick action matters. First, disconnect that device from the network right away. Next, cancel any VPN login details that may be exposed. Finally, check the device closely for extra harmful files or hidden access points left behind by attackers.
This scam shows how normal, everyday activities like job hunting can become a trap. A real interview process rarely, if ever, asks a candidate to install unfamiliar software this early. IT workers, especially those with access to sensitive company systems, remain a favorite target for skilled attackers like these.
By blending a real company’s name, a trusted software platform, and a well-known VPN protocol, UAC-0145 built a scam that feels believable at every step. Staying alert and double-checking every request, no matter how convincing it seems, remains the best defense against tricks like this one.
