Russian military intelligence hackers are reportedly impersonating recruiters to trick Ukrainian IT professionals into installing malicious software. Ukraine's Computer Emergency Response Team (CERT-UA) confirmed that the campaign has been active since at least May and is attributed to Sandworm, a hacking group associated with Russia's GRU military intelligence agency, also known as APT44 or Seashell Blizzard.
The operation primarily targets system administrators and other IT specialists. Attackers reportedly browse legitimate Ukrainian job boards for potential victims, review their resumes, and then initiate contact under the guise of a recruitment company. In one case investigated by CERT-UA, the attackers claimed to represent "Atlas Business Group" and were recruiting for a project involving "Sopra Steria Bulgaria," a division of a legitimate international IT services firm.
Initial contact was made through a job website's built-in chat, after which conversations were moved to Telegram. A fake HR manager conducted an initial screening, asking standard questions about work preferences and English proficiency. Candidates were then invited to a Zoom interview with an English-speaking man, estimated to be between 30 and 35 years old. CERT-UA did not specify if this individual was a genuine participant or an AI-generated persona.
As the recruitment process progressed, candidates received emails with instructions for a supposed technical interview. Victims were told to connect to a corporate network using WireGuard, a legitimate open-source VPN protocol, to complete test assignments. The sender's email address was designed to mimic one from a regional Sopra Steria office.
When candidates attempted to connect using the provided files, they encountered errors. The purported recruiter then instructed them to download a custom VPN application called "SopraVPN." This application was hosted on the software distribution platform SourceForge and linked from a website designed to resemble Sopra Steria's official site.
Installing "SopraVPN" was the critical step in compromising the victim's computer. CERT-UA stated that the hackers developed the application using legitimate WireGuard open-source code but modified it to enable the covert execution of malicious commands on the victim's device. Some of these commands were encrypted and embedded within the VPN configuration files, making them more difficult to detect during a basic inspection.
CERT-UA has not disclosed the total number of individuals targeted or the ultimate objectives of the attackers. At the time of the report, the Telegram account used by the alleged Atlas Business Group recruiter was still accessible, though the associated job advertisement had been removed.
Sandworm has been active for over a decade and is linked to several significant cyber operations, including attacks on Ukraine's electricity grid. The use of fake recruitment campaigns to gain system access is not unique to this group; Western intelligence agencies have previously warned of similar tactics employed by Chinese intelligence officers and North Korean hackers. These campaigns often aim to steal credentials, cryptocurrency, or compromise employees with access to sensitive information.
