Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
Summary
Russian nation-state threat actors, specifically the Sandworm-linked UAC-0145 group, are targeting IT workers in Ukraine through a social engineering campaign. They pose as recruiters and use fake job interviews to trick victims into installing malware disguised as a VPN client.
IFF Assessment
FOE
This campaign represents a sophisticated social engineering attack by a known nation-state threat actor, aimed at compromising IT infrastructure in Ukraine.
Defender Context
This incident highlights the evolving tactics of nation-state threat actors, who are increasingly using targeted social engineering to gain initial access. Defenders should be wary of unsolicited job offers and recruiter communications, especially those that request the download or installation of software.