Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands

AI Summary

CERT-UA has linked a social engineering campaign running since at least May 2026 to UAC-0145, a Sandworm (APT44/GRU) subgroup, which poses as tech recruiters to deliver a trojanized WireGuard VPN client that can execute attacker commands on victim systems. The campaign specifically targets Ukrainian IT professionals and system administrators, exploiting trust in legitimate job recruitment workflows to gain persistent access.

Read full article → https://thehackernews.com/2026/08/sandworm-linked-…

Relevance score: 82.0/100

# More from August 12

1
Microsoft Patches 398 Flaws Including a Windows Driver Zero-Day Under Active Attack The Hacker News
2
Gunra Ransomware Exploits Fortinet and Schneider Electric Flaws to Breach Networks The Hacker News
3
DeadLock Ransomware Uses Polygon Smart Contracts to Make Extortion Infra Harder to Disrupt The Hacker News
4
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing The Hacker News
5
Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE The Hacker News
6
Zoom Annotation Flaws Could Let a Meeting Participant Hijack Another Attendee's Client The Hacker News
7
Hackers Breach Polish Power Plant Controls via Private Cellular Network and Shut Turbine The Hacker News
9
Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers The Hacker News
10
A Malicious SIM Card Can Run Attacker Code Inside the Modems Behind Cellular IoT Devices The Hacker News