The Ukrainian government's Computer Emergency Response Team (CERT-UA) and the State Service for Special Communications have warned of a new dangerous attack. Hackers from the Sandworm group, which is associated with Russian military intelligence, are looking for potential victims among IT specialists and system administrators on job search sites.
The Ukrainian government's Computer Emergency Response Team (CERT-UA) and the State Service for Special Communications have warned of a new dangerous attack. Hackers from the Sandworm group, which is associated with Russian military intelligence, are looking for potential victims among IT specialists and system administrators on job search sites.
The attackers developed a complex scheme that simulates the real hiring process in order to imperceptibly infect the computers of specialists with malicious software, the CERT-UA team reports .
Hackers act as convincingly as possible using social engineering techniques. First, they find the victim's resume and contact them on behalf of well-known IT companies (for example, ATLAS Business Group or Sopra Steria).
The conversation is transferred to Telegram, where the "HR manager" discusses the working conditions. Then, a real Zoom call in English is scheduled with the interviewer.
The candidate is sent an email with files to connect to the corporate network via a VPN (based on Wireguard) and instructions for completing a test. The email comes from a fake domain that closely resembles the company's real office.
An error occurs during connection. The "recruiters" offer to download their own modified application - "SopraVPN", which contains hidden malicious code. Once launched, it silently downloads and executes viral commands on the computer (both Windows and Linux).
The main goal of the hackers is to gain access to the IT professional's device, and through it, to the networks of the companies or providers where he works. According to CERT-UA, this campaign has been going on since at least May 2026.
Check domains: Always pay attention to the exact email address from which the letters come (criminals often change one or two letters in the company name).
Do not download third-party VPN clients: If you are asked to install unofficial or "specially prepared" software from third-party resources for a test task, this is a reason to be wary.
Managed Device Rule: Companies (especially telecom operators and the IT sector) are recommended to provide access to corporate resources only from controlled devices with installed protection systems (EDR), even if the employee is working remotely from his own PC.
