In the modern cyber threat landscape, the boundary between a specialist's personal digital space and a company's corporate perimeter has almost vanished. Attackers from the UAC-0145 group have turned the standard IT hiring process into a highly effective vector for compromising corporate networks. By leveraging professional communication, fake job offers, and modified software, they successfully bypass traditional security systems. The problem is critical: experienced engineers, accustomed to the rapid deployment of test environments, download malicious toolkits disguised as legitimate VPN clients, granting attackers direct access to the internal resources of their current or future employers.
Anatomy of the UAC-0145 attack: how fake recruiting becomes an entry point
The activity of the UAC-0145 group, linked to the use of fake job offers, has been tracked by CERT-UA since at least May 2026. The attack scheme begins with classic social engineering, executed at an exceptionally high professional level. Attackers create convincing recruiter profiles on professional networks or contact candidates directly via messengers. Specialists are offered attractive collaboration terms, interesting projects, and a fast-tracked technical selection process.
The next step in the scenario is an invitation to a technical interview with an HR manager via Zoom or another video conferencing platform. During the call, the candidate is informed of the need to complete a practical task within the company's isolated infrastructure. A seemingly logical requirement is presented: connect to a corporate VPN environment to perform the test task on one's own device. The candidate is provided with a link to download a special client, allegedly configured for access to a test bench. This moment is the point of no return, where the "test environment" becomes a tool for the total compromise of the workstation.
Modified WireGuard: why antivirus software misses the malicious VPN client
The technical essence of the attack lies in the use of a modified WireGuard client (also known as SopraVPN) for Windows and Linux operating systems. It is important to emphasize that this is not a vulnerability in the WireGuard protocol itself. The protocol remains secure, but the attackers modified the code of the official application, adding hidden malicious functionality.
When a user runs the installer, the program may indeed establish a VPN connection to avoid raising suspicion from a technically savvy candidate. However, in the background of the Windows version of the modified client, decrypted PowerShell code is executed. This script creates a scheduled task for persistence and downloads an additional malicious payload from a command-and-control (C2) server.
Traditional antivirus solutions often miss this threat. The executable file itself is based on legitimate WireGuard code, and the execution of PowerShell scripts is masked as standard VPN network interface initialization procedures. As noted in the ENISA Threat Landscape 2025 report, supply chain attacks, targeted phishing, and the use of legitimate software remain leading methods for bypassing classic signature-based analysis.
Psychological blind spot: why experienced IT specialists follow hacker instructions
The IT community possesses a high level of technical expertise, yet this very confidence often becomes a weak point. Engineers, system administrators, and developers work daily with dozens of different tools, consoles, and environments. Installing a new VPN client, a Docker container, or running a script to configure an environment is a routine operation for them.
When a candidate is in the job-seeking process, their level of vigilance naturally decreases due to the desire to make a good impression on a potential employer. The requirement to connect to a VPN is perceived as a sign of the hiring company's security maturity. A cognitive dissonance arises: the specialist believes the company cares about its security by restricting access to the test bench via VPN, and therefore installs the provided software on their device without hesitation. If this device simultaneously serves as their work tool at their current job (a classic BYOD scenario), the entire infrastructure of their current employer is at risk.
Technical countermeasures: how to protect the corporate perimeter from BYOD compromise
To protect an enterprise from such threats, it is necessary to completely abandon the concept of perimeter-based trust and implement a Zero Trust architecture, relying on Microsoft's guidance on identity and access management.
According to CERT-UA recommendations, the primary step is to transition to using exclusively managed devices. Corporate security policies must strictly prohibit direct access to critical resources (such as Git repositories, AWS/Azure cloud management consoles, or internal databases) from unmanaged (BYOD) devices without an installed EDR. Every device attempting to connect to the network must undergo continuous monitoring.
Furthermore, it is necessary to configure software execution restriction policies using Windows Defender Application Control (WDAC) or AppLocker. This will block the execution of unsigned PowerShell scripts and the launch of any third-party VPN clients that are not on the whitelist of approved corporate software.
Monitoring and detection: anomalies in workstation behavior that require immediate response
Effective protection according to the NIST Cybersecurity Framework (CSF) 2.0 methodology requires not only preventive measures (Protect) but also the ability to quickly detect incidents (Detect). In the case of UAC-0145 attacks, the security operations center (SOC) must configure monitoring for specific endpoint events.
Particular attention should be paid to monitoring the creation of new scheduled tasks. In Windows, the creation of a scheduled task is recorded in the security log under Event ID 4698. Any appearance of a new task initiated by processes other than standard system installers should trigger an immediate alert. It is also necessary to analyze the network activity of PowerShell processes. If a local script attempts to establish a connection with external IP addresses that do not belong to known cloud services, this is a direct sign of compromise.
In the context of developing and maintaining complex enterprise systems, Softengi (a member of the Intecracy Group alliance) employs secure development and environment administration methodologies, where engineer access to source code and infrastructure is strictly regulated through managed devices, isolated development environments, and multi-factor authentication without exceptions for temporary contractors. This approach minimizes the risks of using BYOD and neutralizes threats associated with the compromise of specialists' personal devices.
Checklist for assessing IT infrastructure readiness against device compromise attacks
| Control vector | Technical security measure |
|---|---|
| BYOD policy | Is direct access to critical corporate resources (Git, cloud consoles, databases) prohibited from unmanaged devices without an installed EDR? |
| Software execution control | Are AppLocker or Windows Defender Application Control (WDAC) policies configured to block unsigned PowerShell scripts and third-party VPN clients? |
| Scheduled task monitoring | Is the collection and analysis of new Scheduled Tasks (Event ID 4698) configured on administrator and developer workstations? |
| Test environment isolation | Do candidates and new employees perform test tasks exclusively in isolated cloud Sandbox environments that have no connection to the local network? |
| Multi-factor authentication (MFA) | Is phishing-resistant authentication (FIDO2) implemented for corporate account access to prevent session hijacking via infostealers? |
FAQ
How to detect if a modified WireGuard client from UAC-0145 is installed on a workstation?
Check for atypical scheduled tasks (Event ID 4698) and processes like SopraVPN. Also, monitor PowerShell network activity directed at unknown external hosts.
What are CERT-UA's recommendations for protecting against fake recruitment attacks?
CERT-UA recommends granting access to corporate resources only from managed devices with EDR systems installed, configured software restriction policies (e.g., AppLocker), and continuous security event monitoring.
Why do standard antivirus solutions not always block the SopraVPN/WireGuard threat?
Attackers use legitimate WireGuard code as a base, which allows them to bypass signature analysis. The malicious PowerShell code is decrypted directly in memory during execution, masking itself as VPN initialization processes.
Data sources
- CERT-UA: Соціальна інженерія у виконанні UAC-0145: компрометація у процесі працевлаштування
- Microsoft: Zero Trust identity and access management
- NIST Cybersecurity Framework (CSF) 2.0
- ENISA Threat Landscape 2025
- vertexaisearch.cloud.google.com: UAC-0145 Uses Fake CAPTCHA and Security Apps Against Ukraine - Gridinsoft Blogs
- vertexaisearch.cloud.google.com: UAC-0145 Uses ClickFix CAPTCHAs to Infect Ukrainian Devices wih Malware