Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands

The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware. CERT-UA pinned the activity on a threat cluster it tracks as UAC-0145, which is a subgroup within Sandworm (aka APT44,

The article reports that CERT-UA attributed a recruiter-themed social engineering campaign to UAC-0145, a Sandworm-linked cluster, targeting Ukrainian IT staff with fake job interviews that lead victims to install a trojanized VPN client. The malicious VPN is described as a modified WireGuard-based application that can decrypt embedded payloads and execute commands on the victim host. RealGround analysis: this is primarily a nation-state malware/social-engineering operation rather than an AI-specific attack, but it is relevant to AI security because AI-enabled recruiting, chat, and workflow systems could be abused to scale similar impersonation and lure tactics.