🟠 High | Source: The Hacker News
A Russian state-linked threat group (UAC-0145, a Sandworm subgroup) is targeting Ukrainian IT workers with fake job interview lures, tricking them into installing a malicious VPN client that grants attackers remote command execution on victims’ machines. The campaign is a social engineering operation disguised as legitimate recruitment activity. This matters because IT workers with privileged access to infrastructure are high-value targets, and compromised endpoints can serve as footholds into cloud and enterprise environments.
Security Architect’s Take: Enforce strict controls on software installation across developer and IT workstations, and ensure VPN or remote-access tooling is allowlisted via MDM or endpoint policy. Brief engineering teams on recruitment-themed spear-phishing, particularly any unsolicited requests to install software as part of a ’technical interview’ process.
Original advisory: Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands