UAC-0145 Uses Fake Interviews for Malware Distribution

The Computer Emergency Response Team of Ukraine (CERT-UA) has uncovered a new social engineering campaign conducted by the Russian threat group UAC-0145, part of the Sandworm collective. This campaign aims to deceive IT professionals in Ukraine by posing as recruiters and offering fake job interviews. The goal is to distribute malware that is installed via a VPN capable of executing commands. The threat actors employ a variety of tactics to lure their victims. They create fake job postings and utilize social media as well as job portals to disseminate their offers.

Communication often occurs through messaging services to create an appearance of legitimacy. The attackers attempt to gain the trust of their targets by presenting themselves as professional recruiters. A central element of this campaign is the request for victims to download a specific VPN software. However, this software is not just a VPN; it also contains features that allow the attackers to execute commands on the infected system. CERT-UA has determined that the malware is capable of stealing data and conducting further malicious activities.

The security agency has informed the IT community in Ukraine about the dangers of this campaign and recommends exercising caution when applying for job offers. In particular, potential applicants should be wary of downloading unknown software applications and avoid suspicious communication channels. The warning comes at a time when cyber threats in the region are increasing. UAC-0145 is known for its aggressive tactics and has previously conducted other attacks on Ukrainian institutions. The group is linked to various cyberattacks targeting critical infrastructures.

CERT-UA has identified the activities of UAC-0145 as part of a broader strategy to destabilize Ukraine. Ukrainian authorities have taken measures to strengthen cyber defense and educate the public about the risks of cyberattacks. Training and information campaigns are intended to raise awareness of such threats. Collaboration with international partners is also being intensified to improve the security situation. The threat posed by UAC-0145 is not limited to Ukraine.

Experts warn that similar tactics could also be employed in other countries. The use of fake job offers as a means of distributing malware could become a growing problem, especially in times of economic uncertainty. The security situation in Ukraine remains tense, and cyber defense will continue to play a central role in protecting critical infrastructures. CERT-UA has urged the IT community to remain vigilant and report suspicious activities. The agency plans to provide regular updates on the activities of UAC-0145 and other threat actors.

The malware distributed by UAC-0145 could cause significant damage if not detected in a timely manner. CERT-UA has already developed measures to identify and combat this threat. The agency has also published a list of indicators of compromise to help businesses and individuals recognize potential attacks early. On August 14, 2026, the agency released a detailed analysis of the threat, containing specific technical details about the methods and tools used.

This information is intended to enhance defensive measures against UAC-0145 and strengthen IT security in Ukraine. The threat from UAC-0145 exemplifies the ever-evolving tactics of cybercriminals. The IT community is urged to take proactive measures to protect against such attacks. CERT-UA emphasizes the importance of training and awareness initiatives to increase resilience against cyber threats. The security agency plans to release further information about the activities of UAC-0145 in the coming weeks to keep the public informed of the latest developments.

Collaboration with international partners is deemed crucial to strengthening cyber defense and combating threats. The malware used by UAC-0145 could be capable of stealing data and compromising systems, which could have significant implications for IT security in the region.