Sandworm / UAC-0145 — SopraVPN Fake-Recruiter Campaign

Sandworm (GRU Unit 74455 / APT44 / Seashell Blizzard), through its sub-cluster UAC-0145, is running a patient, human-driven social-engineering campaign against Ukrainian IT and system-administrator professionals, active since at least May 2026 and formally attributed by CERT-UA on 2026-08-08 (advisory cert.gov.ua/article/6318863), with independent corroboration published 2026-08-10/11 by The Record, BleepingComputer, The Hacker News and TechTimes.

Attackers pose as recruiters — impersonating an IT firm called "ATLAS Business Group" — after reviewing victim résumés on legitimate job-search platforms. Contact moves from the job site's chat to Telegram, where a fake HR manager claiming to screen for Sopra Steria Bulgaria (a real company, not affiliated with the attackers) runs a preliminary chat, followed by a Zoom interview with an English-speaking man reported as 30–35 years old — CERT-UA itself could not rule out that the interviewer was an AI-generated persona. A follow-up email delivers a WireGuard VPN configuration for a bogus "technical assessment," deliberately built to fail to connect.

When the connection fails, the fake recruiter directs the victim to a spoofed site styled to resemble Sopra Steria Bulgaria (soprasteria-bg[.]com) to download "SopraVPN," a trojanized WireGuard client hosted on SourceForge. SopraVPN is compiled from genuine WireGuard source code with a backdoored config parser: a non-standard SymmetricKey option in the .conf file carries a BASE64-encoded AES-256-GCM blob (nonce + ciphertext + tag); the AES-256 key is the 32-byte decode of the config's own PrivateKey value; the decrypted PowerShell/command payload is then handed to WireGuard's legitimate runScriptCommand mechanism — the same internal call the standard PostUp option uses — so the attacker's command runs automatically and silently the moment the tunnel comes up. A second layer of obfuscation replaces stock Base64 with a custom alphabet, shuffled via Fisher-Yates and seeded from the CRC32 of the SymmetricKey value, hiding PrivateKey/PublicKey from casual inspection. The malicious code lives in data the config file carries, not in the binary — a plain hash/signature check of the SopraVPN executable alone will not reveal the backdoor.

On Windows, the decrypted command creates a scheduled task and downloads a second-stage payload from the internet. On Linux, it uses cURL to retrieve a second-stage executable from attacker infrastructure reached through the newly-established VPN tunnel itself (the malicious config embeds the attacker's own DNS server IP); CERT-UA's captured artifact shows the drop staged at /usr/libexec/timesyncd-check, masquerading as a systemd time-sync helper.

This is a different initial-access chain than the previously published UAC-0145 ClickFix/EtherHiding HuntPack (CAPTCHA lures, a distinct typosquat C2 domain, GHETTOVIBE/FLUIDLEECH/FREAKYPOLL). No CAPTCHA, no browser paste — the lure here is a fabricated hiring process and the payload is a config file, not a script. Detection priorities are (1) exact hash/filename matching on the SopraVPN binary and malicious .conf artifacts, (2) the anomalous-child-process fingerprint of a WireGuard-family parent spawning PowerShell (Windows) or an unexpected shell/cURL chain (Linux) — a legitimate WireGuard tunnel service never does this, (3) network/DNS activity to the campaign's confirmed lure and C2 infrastructure, and (4) the exact Linux host artifact path /usr/libexec/timesyncd-check.

Defender priority: the victims of this chain are, by design, system administrators and IT staff with privileged network access. A single successful SopraVPN install can hand the attacker a persistent scheduled-task foothold and a live route into the corporate perimeter riding on top of what the victim believes is a "corporate VPN." CERT-UA's own top recommendation — restrict corporate resource access to managed, EDR-enrolled devices, including personally-owned equipment used for "hiring assessments" — closes the single biggest gap this campaign is built to exploit.

Security note (pipeline integrity): all five fetched sources were reviewed for embedded instructions directed at an AI analysis pipeline (prompt-injection). None was found — every source is ordinary news/advisory prose, treated throughout as data to analyze, never as instructions to execute. The one literal attacker-authored shell command quoted in the CERT-UA advisory (the Linux timesyncd-check downloader one-liner) is reproduced in this pack strictly as a host indicator/behavioral signature for detection engineering — it was never executed or treated as a directive.

Web-hunter decision: CERT-UA is treated as the sole authoritative source for atomic indicators; the four secondary sources are used only for narrative corroboration, dating, and defender framing. Every hash, domain, IP, filename and host-path value in §4 and §10 is copied character-for-character from the saved CERT-UA snapshot (Sandworm-SopraVPN-Hunt-sources/01-certua-advisory-6318863.txt) rather than from secondary paraphrase, to eliminate transcription drift between sources.

Email gateway

Search inbound mail for .conf attachments whose content contains the string SymmetricKey (not a legitimate WireGuard option), and for links to soprasteria-bg.com, soprasteriabg.com or atlasgroup-ua.com.

DNS resolver / firewall logs

Alert on any resolution of soprasteria-bg.com, soprasteriabg.com, atlasgroup-ua.com, douncloud.site; feed all four to an RPZ/sinkhole (Playbook 1, §13).

Windows Event Log / Sysmon

Security 4698 (scheduled task created) correlated with a parent process named sopravpn*.exe/SopraVPN.exe in the prior five minutes; Sysmon Event ID 1 with ParentImage matching a SopraVPN/WireGuard-family binary and Image=powershell.exe.

Linux auditd

execve records for /usr/bin/curl (or execution of /usr/libexec/timesyncd-check itself) with a parent process from a WireGuard-family binary (wg-quick, wireguard, sopravpn); ausearch -f /usr/libexec/timesyncd-check (Playbook 5, §13).

Config-file content review

grep -RIl "SymmetricKey" against any .conf/.ini file imported for VPN use across managed endpoints. This string does not exist in stock WireGuard and is a hard indicator on its own, independent of any hash or filename.

Proxy / secure web gateway logs

Downloads from sourceforge.net/projects/soprabulgariavpn, /sopravpn, or /soprasteriavpn.

Security-awareness reporting channel (non-technical)

Review any employee reports of a "recruiter" contact referencing ATLAS Business Group or Sopra Steria Bulgaria that asked for a VPN client install as part of a "technical assessment" — this is the highest-value early-warning signal and predates any endpoint telemetry.

Three queries are near-zero-FP path/hash matches strong enough to promote directly; one more promotes with a correlation constraint. The rest stay investigate-only.

Investigate-only (do not promote yet)

• Q2 — the parent-child PowerShell/shell fingerprint has a real benign population on the Linux PostUp side; baseline for 14 days and fold the exclusions into the rule before promotion.
• Q7 — SourceForge is legitimate infrastructure; never promote to an IOA on its own. Keep as a pivot lead only, correlated against Q1.
• Q8 — beaconing cadence needs an environment-specific threshold; baseline for 14 days before any alerting action.
• Q4 — better served by Falcon IOC Management (§10) than by an IOA, since it is pure atomic domain/IP matching.

Deployment path

1. Endpoint security → Custom IOA rule groups → create a Windows/Linux rule group named Sandworm-SopraVPN.
2. Add each rule in Monitor action first; assign the group to a pilot prevention policy covering a small subset of workstations.
3. Review hits daily for 14 days, folding every benign hit into the rule's exclusion list.
4. Promote to Detect (Q3) and Prevent (Q1, Q5, Q6) estate-wide.

Use only benign, clearly-labelled test artifacts for the positive controls, in an isolated lab VM, and remove them immediately afterwards. Never stage a real SopraVPN sample or connect a production host to the published C2 infrastructure.

This campaign succeeds by exploiting trust at three layers: the hiring process itself (human), the VPN config file (technical, but invisible to binary-only inspection), and the unmanaged endpoint (policy). The controls below close each layer independently, since any one alone still leaves the others exposed.

Playbook 1 — DNS sinkhole for campaign domains (BIND RPZ)

; Prerequisites: BIND 9.8+ with a configured response-policy zone (RPZ);
;                rndc reload permission
; Reboot required: No (rndc reload takes effect immediately, no service restart)
; Rollback: remove the four CNAME records below from the RPZ zone file and
;           rndc reload again

; /etc/bind/db.rpz.sandworm-sopravpn — add these records
soprasteria-bg.com      CNAME   rpz-drop.
soprasteriabg.com       CNAME   rpz-drop.
atlasgroup-ua.com       CNAME   rpz-drop.
douncloud.site          CNAME   rpz-drop.

; then:
rndc reload

; Verify:
dig @<resolver> soprasteria-bg.com   ; expect NXDOMAIN or the sinkhole address

Playbook 2 — Falcon Custom IOC bulk import (falconpy)

# Prerequisites: pip install crowdstrike-falconpy; an API client with the
#                "IOC Manager Write" scope
# Reboot required: No
# Rollback: delete the imported indicators via IOC.indicator_delete() using
#           the returned indicator IDs, or set action="no_action" on each
#           to soft-disable without deleting

from falconpy import IOC

falcon = IOC(client_id="REPLACE_WITH_CLIENT_ID", client_secret="REPLACE_WITH_CLIENT_SECRET")

indicators = [
    {"type": "sha256", "value": "4646ea832a61c9f7bdb11fee64ad82ae6d9856d2f3a4b36a8a4a571145be1260",
     "action": "prevent", "severity": "critical", "platforms": ["windows"],
     "description": "SopraVPN trojanized WireGuard installer (sopravpn_v7)",
     "tags": ["campaign:Sandworm-SopraVPN"]},
    {"type": "sha256", "value": "aeb702f65445d12605a84be6fa31545c71be0bf619b1cbedbee5800a43fc6793",
     "action": "prevent", "severity": "critical", "platforms": ["windows"],
     "description": "SopraVPN.exe trojanized WireGuard client (variant 1)",
     "tags": ["campaign:Sandworm-SopraVPN"]},
    {"type": "domain", "value": "soprasteria-bg.com", "action": "detect",
     "severity": "high", "platforms": ["windows", "linux", "mac"],
     "description": "spoofed Sopra Steria Bulgaria lure site",
     "tags": ["campaign:Sandworm-SopraVPN"]},
    {"type": "domain", "value": "douncloud.site", "action": "detect",
     "severity": "critical", "platforms": ["windows", "linux", "mac"],
     "description": "SopraVPN C2 check-in domain",
     "tags": ["campaign:Sandworm-SopraVPN"]},
    {"type": "ipv4", "value": "139.28.36.23", "action": "detect",
     "severity": "critical", "platforms": ["windows", "linux", "mac"],
     "description": "rogue WireGuard endpoint udp/51820",
     "tags": ["campaign:Sandworm-SopraVPN"]},
]

response = falcon.indicator_create(comment="Sandworm SopraVPN campaign import", indicators=indicators)
print(response["status_code"], response["body"])

Playbook 3 — Windows AppLocker deny rule for SopraVPN-named binaries

# Prerequisites: AppLocker policy service (Application Identity, AppIDSvc)
#                running; Group Policy or Intune available to push the rule
# Reboot required: No (gpupdate + AppIDSvc restart is sufficient)
# Rollback: remove the deny rule from the AppLocker policy XML and re-push,
#           or set the rule to "Audit only" to stop enforcing without deleting it

# Deny rule (path-based), added to an AppLocker XML policy:
# <FilePathRule Id="..." Name="Block SopraVPN / unapproved VPN clients"
#                Description="Sandworm SopraVPN campaign" UserOrGroupSid="S-1-1-0"
#                Action="Deny">
#   <Conditions>
#     <FilePathCondition Path="*\SopraVPN*.exe" />
#   </Conditions>
# </FilePathRule>

# Verify the policy is enforced (not Audit-only):
Get-AppLockerPolicy -Effective -Xml | Select-String "SopraVPN"

# Force a re-evaluation on the target host:
gpupdate /target:computer /force
Restart-Service -Name AppIDSvc -Force

Playbook 4 — Conditional Access: require compliant device for VPN + SSO

# Prerequisites: Entra ID P1 (Conditional Access) or an equivalent NAC/ZTNA
#                enforcement point in front of the VPN concentrator and SSO
# Reboot required: No
# Rollback: set the policy State to "Off" rather than deleting it, so the
#           exact configuration can be re-enabled without rebuilding it

# Conditional Access policy (Entra ID), summarized:
Name:              Require compliant device for VPN + SSO
Assignments:       All users -> Target resource: corporate VPN app registration, SSO apps
Conditions:        Client apps = All; Device platforms = All
Grant control:     Require device to be marked as compliant  (blocks unmanaged/BYOD)
State:             Report-only for 1 week, then Enforced

# Verify (Microsoft Graph PowerShell):
Get-MgIdentityConditionalAccessPolicy -Filter "displayName eq 'Require compliant device for VPN + SSO'" |
    Select-Object DisplayName, State

Playbook 5 — Linux auditd watch for timesyncd-check and curl

#!/usr/bin/env bash
# Prerequisites: auditd installed and running (auditctl available)
# Reboot required: No (auditctl -R takes effect immediately; the rules file
#                  in /etc/audit/rules.d/ persists it across a future reboot)
# Rollback: auditctl -D to clear all custom rules, or remove the specific
#           watch lines below from the rules file and re-run augenrules --load

# Watch the exact masquerade path CERT-UA published
echo '-w /usr/libexec/timesyncd-check -p wax -k sandworm_sopravpn' >> /etc/audit/rules.d/sandworm-sopravpn.rules

# Watch curl execution — pair with process-ancestry review in Falcon (Q6)
echo '-w /usr/bin/curl -p x -k sandworm_sopravpn_curl' >> /etc/audit/rules.d/sandworm-sopravpn.rules

augenrules --load
auditctl -l | grep sandworm_sopravpn

# Query after the fact:
ausearch -k sandworm_sopravpn -i

Escalation trigger: a confirmed tunnel-up (Q4/Q5 hit) plus any child-process activity off the WireGuard binary (Q2, Q3, or Q6) means the backdoor fired, not just installed. Escalate to full incident response immediately — Sandworm's historical pattern is foothold, credential harvesting, lateral movement, then potentially destructive action against Ukrainian and allied infrastructure.

Known gaps and what to do about them

• Human-layer recon/resource-dev (3 gaps). Everything before the malicious download happens off any endpoint you control. Closing this is a policy and awareness problem (§12 Immediate #3, Strategic #2), not a detection problem.
• Config-content backdoor. The SymmetricKey string and the custom Base64 alphabet live inside a data file, not in process/network telemetry — Falcon's process and network event model cannot inspect arbitrary config-file contents. The native grep hunt in §7 and the endpoint audit in §10 are the only coverage for this specific technique.
• Encrypted tunnel payload. Once the WireGuard tunnel is up, the Linux second-stage cURL retrieval travels inside it — Falcon sees the outer tunnel connection (Q5) but not the inner HTTP(S)/plaintext request to attacker infrastructure.

Validation summary: gates G1–G8 in §11 govern promotion. G1 (telemetry present, both platforms) and G3–G5 (positive controls) must pass before any query is treated as coverage; G2 and G6 (baseline and negative control) must pass before any IOA moves past Monitor; G8 governs the move to Prevent. A query that has not passed its gate is a hypothesis, not a detection.