CERT-UA has exposed a targeted social engineering campaign by UAC-0145, a Sandworm subgroup linked to Russian state actors, targeting Ukrainian IT workers. The threat actors pose as recruiters and conduct fake job interviews to manipulate targets into installing a VPN application that functions as a remote access trojan.
The attack chain begins with initial contact via LinkedIn or email, where threat actors claim to represent legitimate tech companies. They invite targets to participate in technical interviews. During these interactions, attackers direct victims to install a VPN tool ostensibly required to access interview platforms. The VPN software actually provides remote command execution capabilities, allowing operators to control compromised systems.
Ukrainian IT workers represent high-value targets for Russian intelligence operations. These professionals often have access to critical infrastructure, government networks, or sensitive corporate systems. By focusing recruitment efforts on this demographic, Sandworm gains potential entry points into protected environments.
The campaign demonstrates the group's continued reliance on social engineering despite possessing sophisticated technical capabilities. Fake job interviews reduce skepticism because they tap into legitimate hiring processes. The use of VPN software adds credibility to the pretext and explains why targets might grant elevated system permissions.
Organizations should implement controls to prevent installation of unauthorized VPN clients. Employee training on recruiter verification procedures, suspicious interview requests, and LinkedIn vetting protocols strengthens human defenses. IT teams should monitor for unexpected VPN connections and review network logs for anomalous remote access patterns.
CERT-UA recommends blocking known malicious VPN signatures and enforcing application whitelisting to prevent execution of unauthorized remote access tools. Organizations operating in Ukraine or employing Ukrainian IT professionals face elevated risk from this campaign. Targeted workers should verify job opportunities through official company websites and contact information rather than through recruiter outreach alone.