If someone in your business has technical skills, they are a target – and not only during work hours. Ukraine’s national cyber emergency team, CERT-UA, has reported a campaign that approaches system administrators and IT staff with fake job offers, then uses the “interview” process to get malware onto their computer.
How the trick works
The attackers read resumes on job sites, make contact over Telegram, and arrange a video interview on Zoom. It all looks like ordinary recruitment. The candidate is then given a technical task that requires connecting to the company VPN. The first attempt fails with an error message, and the candidate is pointed to a download for a VPN client called SopraVPN, hosted on SourceForge – a software site plenty of technical people already trust.
That client is a tampered copy of WireGuard, a genuine and widely used VPN tool. Buried in its settings is code that runs quietly in the background, sets itself to start again automatically, and pulls down further malware. In one run of the campaign the attackers impersonated a real European IT firm using look-alike email addresses. CERT-UA links the activity to a Russian state-backed group tracked as Sandworm and says it has been running since at least May.
Why it matters to a smaller business
You do not need to be the target to wear the damage. Job hunting is personal, so it happens on personal laptops and phones – the same ones that open your email, your files and your Microsoft 365 account. And the bait here was not an obvious dodgy attachment. It was a useful tool, with a small change hidden inside it, downloaded from a reputable site.
Four things worth doing this week
- Agree a short list of approved software. Installing anything outside it should be a conversation, not a click.
- Download tools from the vendor’s own website, never from a link sent by a recruiter or a chat contact.
- Treat “connect to our VPN to do the test task” as a red flag. No legitimate employer needs that before you are hired.
- Keep work accounts off personal machines where you can, and turn on multi-factor authentication everywhere.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.