UAC-0145 Deploys WireGuard Fork with AES-Encrypted Command Execution via Fake Ukrainian Job Interviews

CERT-UA traced the operation to initial contact on domestic job boards, followed by Telegram and Zoom interactions that escalate to a bogus Sopra Steria Bulgaria technical assessment. Victims receive WireGuard configs pointing to a custom client hosted on SourceForge under three spoofed projects; the binary accepts a BASE64 SymmetricKey that decrypts to AES-256-GCM-wrapped PowerShell passed to runScriptCommand. The Windows build also registers a scheduled task for secondary payload retrieval while the Linux variant uses cURL over the tunnel.

The technical evidence shows clear code reuse from the official WireGuard repository with only the configuration parser and post-up hooks altered, matching Sandworm's documented pattern of minimal, high-impact modifications to legitimate remote-access tools seen in earlier Industroyer and NotPetya supply-chain operations. Independent samples from the same SourceForge accounts were absent from public repositories at disclosure, indicating rapid takedown or private distribution.

Job platforms and Western consultancies remain soft targets because their hiring workflows lack cryptographic verification of interview materials or VPN binaries. The campaign's use of synthetic Zoom participants, if confirmed, would mark an operational evolution that reduces human exposure while preserving the social-engineering vector that has produced high success rates against system administrators.

Defenders should expect similar lures against Eastern European infrastructure operators within the next quarter, with secondary payloads likely shifting toward credential harvesters or lateral-movement implants rather than immediate destructive wipers.