bleeping-computer · Crawled Aug 11, 2026
Sandworm hackers target IT pros with trojanized WireGuard VPN client
2 IoCs 1 Actors
Read original article ↗
AI Summary
The Russian threat group Sandworm, operating as UAC-0145, has been targeting IT professionals and system administrators since at least May 2026 through a social engineering campaign involving fake job offers. The attackers pose as legitimate IT companies, such as Sopra Steria, and lure victims into downloading a trojanized WireGuard-based client called 'SopraVPN' from SourceForge. The malicious client contains a custom Base64 decoder and executes PowerShell code that establishes persistence via scheduled tasks on Windows or downloads additional payloads on Linux through attacker-controlled infrastructure.
AI-extracted · verify before operational use
Extracted Entities 1 found
Indicators of Compromise 2 extracted
MITRE ATT&CK TTPs 25 techniques
T1012 Query Registry · Discovery T1021.001 Remote Desktop Protocol · Lateral Movement T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol · Exfiltration T1053.005 Scheduled Task · Execution T1059.001 PowerShell · Execution T1059.003 Windows Command Shell · Execution T1069.002 Domain Groups · Discovery T1070.001 Clear Windows Event Logs · Defense Evasion T1071.001 Web Protocols · Command And Control T1071.004 DNS · Command And Control T1078.004 Cloud Accounts · Defense Evasion T1083 File and Directory Discovery · Discovery T1087.002 Domain Account · Discovery T1090 Proxy · Command And Control T1090.002 External Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1129 Shared Modules · Execution T1133 External Remote Services · Persistence T1136.002 Domain Account · Persistence T1204.002 Malicious File · Execution T1210 Exploitation of Remote Services · Lateral Movement T1217 Browser Information Discovery · Discovery T1485 Data Destruction · Impact T1490 Inhibit System Recovery · Impact T1566 Phishing · Initial Access