CuraSec

tag: Trojanized-Software · 2 items

Plan Sandworm UAC-0145 Uses Fake Recruiters to Deliver Backdoored VPN
2026-08-12 · The Hacker News · source ↗ #sandworm#social-engineering#trojanized-software
  • Engineer — Learn: Sandworm is delivering trojanized VPN clients through fake job-interview lures targeting IT professionals — a supply-chain-adjacent social engineering vector. No patch action exists, but teams should review policies on installing software provided during recruiting workflows and verify VPN client integrity via official sources only.
  • SOC/IR — Plan: The campaign introduces a new Sandworm TTP: trojanized VPN with command-execution capability delivered via recruiter impersonation. No IOCs are currently available in this disclosure, but detection engineers should queue rules for unauthorized VPN client installs and anomalous outbound connections from VPN processes in anticipation of CERT-UA releasing indicators.
  • Leader — Learn: Sandworm expanding its IT-targeting playbook to recruiter impersonation is notable trend intelligence, but absent evidence of Western-enterprise targeting or published IOCs, this does not require immediate leadership action; file for the next threat-landscape briefing.
Act archived Russian UAT-11795 trojanizes WebEx/Zoom apps to deploy Starland RAT
2026-07-16 · BleepingComputer · source ↗ #trojanized-software#credential-theft#threat-actor
  • Engineer — Plan: Trojanized installers for widely-deployed conferencing tools represent a real supply-chain-adjacent risk; no exploitation signals provided. Audit all WebEx/Zoom deployments to confirm they originate from official signed packages or MDM-managed distribution, and block unapproved installer sources.
  • SOC/IR — Act: Active campaign using trojanized enterprise conferencing apps to drop a credential-stealing RAT; hunt for unsigned or anomalous WebEx/Zoom process trees since the compromise starts before any patch can help. Pull Starland RAT IOCs from the BleepingComputer article and sweep endpoint logs for suspicious child processes or C2 traffic from conferencing app directories.
  • Leader — Learn: Financially motivated Russian actor targeting enterprise collaboration tools is worth noting as sector-level context, but with no confirmed breach at a shared vendor and no enrichment signals, this does not yet require leadership action or customer communication.