Sandworm on CuraSec

Sandworm UAC-0145 Uses Fake Recruiters to Deliver Backdoored VPN

Wed, 12 Aug 2026 11:57:00 +0000

Engineer — Learn: Sandworm is delivering trojanized VPN clients through fake job-interview lures targeting IT professionals — a supply-chain-adjacent social engineering vector. No patch action exists, but teams should review policies on installing software provided during recruiting workflows and verify VPN client integrity via official sources only.
SOC/IR — Plan: The campaign introduces a new Sandworm TTP: trojanized VPN with command-execution capability delivered via recruiter impersonation. No IOCs are currently available in this disclosure, but detection engineers should queue rules for unauthorized VPN client installs and anomalous outbound connections from VPN processes in anticipation of CERT-UA releasing indicators.
Leader — Learn: Sandworm expanding its IT-targeting playbook to recruiter impersonation is notable trend intelligence, but absent evidence of Western-enterprise targeting or published IOCs, this does not require immediate leadership action; file for the next threat-landscape briefing.

Wed, 22 Jul 2026 12:46:13 +0000

Engineer — Learn: The title signals research on an emerging attack class targeting AI/ML toolchains — no enrichment signals confirm active exploitation, so no immediate patch or audit action is warranted, but engineers building AI pipelines should read for architectural implications.
SOC/IR — Plan: A CrowdStrike post explicitly framed around detection of a named technique (SANDWORM_MODE) likely contains TTPs or behavioral signatures worth converting into detections this quarter; no confirmed IOCs or KEV listing to justify an immediate sweep.
Leader — Learn: AI toolchain supply chain attacks as a named, emerging category is useful framing for future policy and budget conversations, but without a confirmed breach or active campaign, no same-week leadership action is required.

Mon, 20 Jul 2026 13:16:24 +0000

Engineer — Learn: ClickFix is a social-engineering technique, not a software vulnerability — no patch or config change applies. Understand the attack pattern (fake CAPTCHA prompts users to paste and run malicious commands) to inform user-awareness training and browser hardening policies.
SOC/IR — Plan: ClickFix produces detectable behavioral patterns — browser processes spawning cmd.exe or PowerShell, clipboard-sourced command execution — worth building or tuning detections for this quarter; no specific IOCs were published to support an immediate hunt.
Leader — Learn: Sandworm/GRU campaign currently focused on Ukrainian targets, making direct exposure unlikely for most US enterprises; useful situational awareness about adversary tradecraft evolution, but no immediate leadership action required.