Fake Corporate VPN Test Creates Scheduled Task and Downloads Malware on Windows

An advanced recruitment-themed intrusion campaign attributed to UAC-0145, a cluster that includes subcluster UAC-0002, also tracked as Sandworm, APT44 and Seashell Blizzard.

The activity, observed since at least May 2026, begins on job-search platforms. Operators review a candidate’s résumé, contact the individual while impersonating an IT company such as ATLAS Business Group, and move the conversation from the platform’s chat feature to Telegram.

A purported HR representative conducts an initial screening, asking routine questions about work arrangements and English-language proficiency. Victims are then invited to a Zoom meeting.

The call is not merely a lure. CERT-UA said the meeting is held with a real English-speaking participant, reportedly a man aged about 30 to 35.

That human interaction adds legitimacy and makes the subsequent technical-interview instructions harder to dismiss as a conventional phishing attempt.

Victims next receive an email containing WireGuard configurations for a supposed corporate VPN, ostensibly required to complete test tasks.

The message also includes a support Zoom link. In the documented case, the sender used mike.weitzman@soprasteria-bg[.]com, a domain crafted to resemble regional branding for Sopra Steria, whose legitimate domains include soprasteria[.]com and soprasteria[.]bg.

The trojanized application is built from WireGuard source code but contains changes that transform configuration parsing into a covert code-execution path.

CERT-UA Researchers said that, the operation targets system administrators and IT specialists through a highly credible, multi-stage hiring process designed to turn a technical interview into a malware delivery mechanism.

Most notably, the modified client accepts a non-standard SymmetricKey configuration option. Its Base64-encoded value carries an AES-256-GCM nonce, ciphertext and authentication tag.

Fake Corporate VPN Test

The client decodes the PrivateKey value into a 32-byte AES key, decrypts embedded PowerShell, and passes that script to WireGuard’s runScriptCommand mechanism, normally used for directives such as PostUp.

The operators also altered Base64 handling to impede inspection. PrivateKey and PublicKey fields use a custom 64-character alphabet generated through Fisher-Yates shuffling.

The shuffle is seeded with the CRC32 value of “SymmetricKey,” enabling the malware to permute the standard alphabet before parsing key material. This layered design conceals the payload within what appears to be a valid VPN profile.

On Windows, the decrypted PowerShell creates a scheduled task and retrieves a second-stage payload from an internet-hosted URL.

On Linux, the counterpart uses cURL to download an executable from attacker-controlled infrastructure over the VPN; the configuration supplies the DNS server address required to reach it.

The campaign demonstrates why recruitment workflows are now a high-value attack surface, especially for privileged technical staff.

Organizations should permit corporate-resource access only from managed endpoints with EDR coverage, enforced security policies and continuous monitoring.

Hiring teams and IT professionals should independently verify domains, software provenance and interview-task requirements before executing software or importing network configurations.

CERT-UA’s official advisory also underscores that a video call, a polished website and a public hosting service do not validate a recruiter or a VPN client.

Security teams should hunt for unexpected scheduled-task creation, unsigned WireGuard-derived binaries, anomalous PowerShell spawned by VPN software, and created profiles across endpoints. Security teams must treat configuration files as executable content, not benign artifacts.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now