Recruitment processes in the IT industry have historically been based on a high level of trust. Candidates readily open files from recruiters, while technical specialists run submitted code and grant applicants access to test environments to evaluate their skills. This communication channel has transformed into one of the most dangerous vectors for targeted attacks. The current campaign by the UAC-0145 group has clearly demonstrated that attackers can exploit trust at every stage of the hiring process, skillfully bypassing traditional perimeter security measures.
Traditional antivirus software and firewalls prove ineffective when compromise occurs at the initiative of users who legitimately have access to the system. Today, recruitment security requires more than just organizational instructions for HR; it demands the implementation of strict engineering barriers, ranging from the complete isolation of test environments to the implementation of a Zero Trust concept for any technical interaction with candidates.
Anatomy of the UAC-0145 attack: how recruitment became a primary social engineering vector
The UAC-0145 campaign, analyzed in detail by the government computer emergency response team CERT-UA, demonstrates a high level of preparation by cybercriminals. Instead of mass-mailing typical phishing emails, attackers create detailed backstories. There are known cases where the attackers' HR representatives conduct realistic technical interviews via Zoom to build trust before sending the specialist a malicious "test task."
The main phase of the attack unfolds during the practical assessment stage. The candidate is asked to perform a task that requires connecting to a corporate "test bench." To do this, the victim is provided with instructions and required to install a modified VPN client. Once this software is installed, the specialist's device becomes an entry point, from which attackers gain access to the internal network to further compromise the infrastructure.
According to the ENISA Threat Landscape 2025 report, phishing and social engineering remain the leading vectors for gaining initial access to systems. At the same time, critical organizations subject to European NIS2 cybersecurity requirements account for a significant portion of all recorded incidents (with a figure of 53.7% in specific attack categories). This underscores that the target is not only small businesses but also large enterprise structures with advanced monitoring systems (EDR).
Why HR training will not stop professional hackers: the limits of organizational defense
Many companies attempt to address the problem solely through regular cyber hygiene training. While knowledge of the basic signs of fraudulent job offers is mandatory, relying exclusively on the human factor to counter targeted attacks is a strategic mistake.
Modern attackers use deep analysis of open-source intelligence to create personalized scenarios. They mimic the communication style of real recruiters and use legitimate platforms to bypass spam filters. If infrastructure security relies solely on the vigilance of an individual employee during a technical interview, compromise is only a matter of time. Security must be engineered.
Zero Trust architecture in the hiring process: from trust to continuous verification
The only reliable approach to organizing secure recruitment is the implementation of a Zero Trust model. In accordance with Microsoft's conceptual identity and access management architecture, every connection request must be fully verified before access is granted, with the mandatory application of the principle of least privilege.
In the context of hiring, this means completely abandoning the concept of a "trusted candidate." Practical implementation of this principle excludes the use of traditional VPN connections for third parties. Instead of providing access to the internal network via tunnels, companies should use Identity-Aware Proxy (IAP) solutions. This allows access to be granted exclusively to a specific web application or interface without passwords, without exposing the rest of the network infrastructure.
Isolating test tasks: how to safely execute candidate code
Evaluating the technical skills of developers requires analyzing and running the code they have written. Running unverified scripts or binary files on a technical interviewer's local machine is a direct path to infecting a workstation. The verification process must be strictly isolated (sandboxing).
All code received from candidates must undergo automated analysis, and its execution must occur exclusively in disposable cloud containers that have no network connection to the company's internal resources and are destroyed after the session ends. If the task involves the candidate working with specific corporate software, the demonstration or interaction should take place via isolated virtual desktops (VDI), where the ability to transfer files to the host is blocked.
Minimizing privileges and access control: engineering barriers against lateral movement
Even with the strictest controls, there remains a possibility that an attacker could gain initial access through the compromise of an employee's account. Here, the architecture of corporate software, which must limit the "blast radius," is of critical importance.
In the context of developing secure corporate systems, Softengi (part of the Intecracy Group alliance) applies Security by Design approaches. When creating custom enterprise solutions and integration platforms, an architecture that accounts for environment isolation from the very beginning is used.
In particular, such solutions can be built on the UnityBase platform (a joint development of Intecracy Group companies, where InBase is a key, but not the only, developer). For projects with increased security requirements, the platform's official documentation recommends using Enterprise or Defence editions. These versions contain powerful access control mechanisms: row-level security (RLS), access control lists (ACL), and detailed audit trails of user actions. This ensures that in the event of a successful account compromise, an attacker cannot move freely within the system, and any abnormal activity will be instantly recorded.
Security matrix for the recruitment pipeline: risks and engineering controls
| Process stage | Typical attack vector | Engineering solution (Control) |
|---|---|---|
| Receiving resumes / portfolios | Malicious macros in PDF/DOCX, phishing links | Automatic file analysis in a sandbox, opening documents exclusively via web viewers without downloading to the host |
| Technical interview | Social engineering via Zoom/Teams, running malicious software for screen sharing | Use of corporate isolated VDI (Virtual Desktop Infrastructure) for demonstrations |
| Executing test tasks | Transmission of malicious code disguised as a repository or archive | Verification of candidate code in isolated cloud containers without access to the local network |
| Granting access to test bench | Requirement to connect via VPN, use of modified clients | Access via Identity-Aware Proxy (IAP) without VPN, passwordless authentication, strict session monitoring |
FAQ
How can a company protect itself from UAC-0145 group attacks during the hiring process?
Implement the Zero Trust concept for HR processes. Refrain from granting candidates VPN access to the infrastructure, verify submitted files in isolated environments, and do not allow technical specialists to run unverified code on their workstations.
How can we safely verify programmer test tasks without introducing a virus?
Never run candidate code or binary files on local computers. Use automated static code analysis and execute it exclusively in disposable, isolated cloud containers that have no access to the corporate network.
Is it safe to ask candidates to connect to our VPN to perform tests?
No, this creates critical security risks. Providing VPN access to unverified external devices allows attackers to penetrate the company network. Instead of a VPN, use an Identity-Aware Proxy (IAP) for controlled access only to the necessary web interfaces.