If you’re a sysadmin or IT pro, you’ve probably taken a call with a recruiter who “found your resume” and wants to move fast. That urgency can feel flattering. It can also be the trap. CERT-UA described a campaign tied to Sandworm (APT44 / UAC-0145) where the ‘interview’ turns into a setup: recruiter outreach, a switch to Telegram, a Zoom call, then a “technical assignment” that asks you to connect to a ‘corporate VPN’ using WireGuard config files. The punchline is ugly: the VPN client is a trojanized WireGuard build called SopraVPN, pushed via SourceForge, and it’s built to run code and pull more payloads once you install it.
How the “Interview” Gets You to Install the Malware (and why smart people fall for it)
The scary part of this campaign isn’t some exotic zero-day. It’s how normal it looks when you’re tired, busy, or excited about a role.
CERT-UA described a flow tied to UAC-0145 (linked to Sandworm / APT44) that targets sysadmins and IT pros by turning a “technical interview” into a job interview scam that installs a fake VPN. The attacker starts by studying resumes posted on job sites, then reaches out directly like any recruiter would.
Here’s the pattern, step by step:
- Resume targeting → recruiter outreach
You get a message that references your background, which immediately lowers your guard. CERT-UA notes they study resumes first, so the approach can feel “personal.”
- Move the conversation to Telegram
The chat shifts off email/LinkedIn into Telegram, framed as “faster coordination.”
That’s a big win for the attacker: fewer platform protections, less traceability, and it feels informal in a way job seekers are used to.
- A Zoom interview in English that feels legit
Next comes a Zoom video interview—a credibility boost. It looks like a real hiring process, not a random DM.
- The “technical assignment” hook
During the interview, you’re given a mock task that “requires access” to internal resources, so they instruct you to connect to a corporate VPN.
You’ll receive WireGuard configuration files for Windows/Linux via email as “interview instructions.”
- A fake problem pushes you into the trojan
The initial download is set up to throw a fake error, and the “recruiter” quickly offers the fix: install a modified WireGuard-based client called SopraVPN, hosted on SourceForge.
The credibility tricks that make this work (even on experienced admins)
Attackers don’t rely on one lie. They stack small, plausible signals:
- Impersonation of a known IT brand
CERT-UA observed an impersonation of Sopra Steria, using email addresses that look like they belong to the company’s Bulgaria office.
- Lookalike domain “proof”
The SourceForge page included a link to soprasteria-bg[.]com to look official—despite having no connection to the real company.
- A workflow that matches real hiring
Recruiters do move fast. Teams do use Telegram in some regions. “Connect to the corporate VPN for the assignment” sounds boringly normal if you’ve ever done contract work.
What makes this trap effective is simple: it targets your professional reflexes. IT people are trained to unblock work, follow setup docs, and treat “VPN access” as routine. The scam just wraps that routine in a familiar sequence—recruiter → chat app → Zoom → assignment—until installing a “VPN client” feels like the next obvious step.
What SopraVPN Actually Does on Windows: the small config tweak that turns into code execution
Once you install the “VPN client,” the risk isn’t just “they can see my traffic.” The SopraVPN build CERT-UA described is a trojanized WireGuard client that turns a normal-looking VPN setup into a clean path to code execution on Windows.
The trick: one extra config option that WireGuard doesn’t normally support
A real WireGuard config is pretty boring. Interfaces, peers, keys, allowed IPs. SopraVPN adds a malicious twist: it supports a nonstandard configuration option called SymmetricKey.
Here’s what that enables, in plain language:
- The client reads the config you import.
- If it finds
SymmetricKey, it uses that value as a decryption key. - It then decrypts and executes embedded PowerShell.
That’s the “small tweak” that matters operationally: it looks like a VPN setting, but it functions like a hidden switch that unlocks the next stage.
Why the fake error matters (it’s not just theater)
CERT-UA notes the downloaded file is configured to show a fake error.
That buys the attacker two advantages:
- You’re primed to accept “fix steps” without arguing.
- You’re less likely to scrutinize the client because you’re busy troubleshooting.
The end result: you install and run the exact build they want, with the exact config they want.
After PowerShell runs: what Windows teams should care about
Once that PowerShell is executing, this stops being “a sketchy interview” and becomes “a compromised endpoint.”
CERT-UA’s report highlights two follow-on actions on Windows:
- Scheduled task creation (persistence): a scheduled task is a simple way to survive reboots and keep running without your attention.
- Additional payload downloads: the malware pulls more code from the internet, which means the initial installer doesn’t need to contain the full toolkit.
The defensive takeaway
If a “corporate VPN” setup requires installing a special client and importing configs that contain unfamiliar keys like SymmetricKey, treat it like you’ve been handed an executable—because that’s effectively what it is.
Linux Isn’t “Safer” Here: second-stage delivery through the VPN + anti-analysis tricks
A lot of IT folks hear “Linux” and relax a bit. In this SopraVPN job interview scam pattern, Linux just changes the delivery method.
CERT-UA’s write-up makes the Linux behavior blunt: once the VPN is established, the malware uses cURL to fetch a second-stage executable from attacker-controlled infrastructure through the VPN.
How the Linux path actually plays out
Think of it like this: the “corporate VPN” isn’t just access to a test environment. It becomes the attacker’s private tunnel into your machine.
On Linux, that flow looks like:
- Bring up the WireGuard tunnel (you think you’re connecting to a lab).
- Pull the next payload over that tunnel using cURL.
- Run a second-stage executable that didn’t need to be present at install time.
Operationally, this is nasty for defenders because a payload downloaded “through the VPN” can blend into what looks like legitimate VPN traffic patterns, especially if you’re only watching north/south internet traffic loosely.
The anti-analysis trick: break Base64 so strings don’t “pop”
CERT-UA also noted a detail that’s easy to skip, but it matters if you’re trying to triage quickly:
- WireGuard’s standard Base64 decoding was replaced with a custom, dynamically generated Base64 alphabet in the trojanized build.
What that means in practice:
- If an analyst tries to decode strings the normal way, they get garbage.
- Key strings become unreadable with standard decoders, which slows down reversing and detection engineering.
- CERT-UA says this also helps protect the embedded PowerShell content from analysis (even if you’re investigating from a Windows-centric mindset).
The takeaway for Linux-heavy teams
Linux isn’t the shield here. The “VPN client” is the weapon, and the VPN link is the delivery channel.
If an interview task asks you to connect to a “corporate WireGuard VPN” and then run anything that pulls binaries via curl/wget, treat it as a second-stage dropper until proven otherwise.
Practical Defenses for IT + Telecom Teams (what to change on Monday morning)
When malware delivery can happen through something as ordinary-looking as a “corporate VPN,” you need controls that don’t care whether the user was tricked, tired, or rushing.
CERT-UA’s advice to telecom providers and IT companies targeted in this campaign is blunt: restrict corporate resource access to managed, continuously monitored devices protected by EDR—and that includes cases where staff use personal equipment.
The Monday-morning checklist (high impact, low debate)
- Lock corporate access to managed devices only
If you can do only one thing, do this.
- Block access to sensitive resources unless the device is:
- Managed (MDM/endpoint management enrolled)
- Continuously monitored
- Covered by EDR
This directly cuts off the “I installed it on my personal laptop to finish the assignment” failure mode.
- Treat “EDR coverage” as a yes/no question, not a slide deck
CERT-UA calls out the risk of personal equipment being used for work access.
So validate reality:
- Any device that can touch corporate email, VPN, admin panels, or ticketing needs EDR.
- If that’s politically hard, don’t compromise—remove access from unmanaged endpoints.
- Add interview-specific guardrails (because this is now a known tactic)
This campaign targets IT pros through recruiter workflows and VPN “assignments.”
Put these rules in writing:
- Recruiter verification rule: if outreach moves to Telegram + a quick Zoom + “install this VPN,” require independent verification through a known company channel before anyone proceeds.
- WireGuard config files are high-risk artifacts: handle them like you’d handle a script attachment. If someone external sends a
.confand asks you to “just import it,” assume it can be weaponized. - No personal-device VPN into corp: don’t allow “temporary” exceptions. That’s exactly what attackers bank on.
A practical way to socialize this internally
Don’t frame it as “people are careless.” Frame it as “attackers copied a normal hiring process.”
When leadership hears that CERT-UA is explicitly warning telecom and IT orgs to restrict access to managed, monitored, EDR-protected devices—including when staff use personal gear—this stops sounding like paranoia and starts sounding like baseline hygiene.
A simple rule that prevents most of this: separate your ‘career’ device from your ‘production’ access
If you’ve ever been halfway through an interview task at 10pm, you know how the bad decisions happen. You’re not “being reckless.” You’re trying to finish.
So here’s the rule that blocks a huge chunk of job-interview malware risk:
The rule
Never install “company VPN” software (or import VPN config files) from an interview process on the same machine you use for real admin work.
Not on your daily-driver laptop.
Not on the box with saved SSH keys.
Not on the machine that can reach prod.
If the “assignment” is legit, they’ll still get what they need from a clean environment. If it’s a trap, you’ve just kept it away from anything that matters.
What “separate” looks like in real life (pick one)
You don’t need a perfect lab. You need a blast radius you can live with.
- Option A: Dedicated “career” laptop
- Fresh OS
- No password manager logged in
- No SSH keys, no corp bookmarks, no tokens
- Browser profiles kept separate (work vs job hunt)
- Option B: A locked-down VM
- Snapshot before you start
- Revert after every “technical assignment”
- No shared clipboard if you can avoid it
- No shared folders by default
- Option C: Cloud test box (for technical screens)
- Temporary instance
- New keys per session
- Tear it down when you’re done
A second rule that helps: stop giving strangers a straight line to your identity
A lot of recruiter scams start with a phone number and an email, then spiral into account takeovers, social engineering, and stalking across services.
Using masked contact details during the job hunt can cut that off. Cloaked is useful here because it lets you create masked emails and phone numbers for sign-ups and recruiter outreach, so if a “recruiter” turns out to be fake, they can’t easily pivot from your contact info into your wider accounts.
The mindset shift
Treat interview tooling like you’d treat a random GitHub repo with an installer: maybe it’s fine, maybe it’s not. Either way, it doesn’t belong anywhere near the machine that holds your real access.
