threat-intel
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
High
Summary
Russian state-sponsored threat actors, linked to the Sandworm group, are using fake recruitment campaigns to trick IT professionals in Ukraine into installing malware. They impersonate IT companies like Sopra Steria Bulgaria, using social engineering tactics and AI-generated personas to gain access to systems and deploy a custom VPN solution that allows them to execute arbitrary commands. This campaign is ongoing since May 2026.
Summary written automatically in our own words from the original article, which belongs to its publisher and remains the reference. It may contain errors. Sources & data