SANDWORM USES FAKE JOBS TO DISTRIBUTE TROJANIZED WIREGUARD

Sandworm, a Russian state-sponsored hacking group, has been conducting a targeted campaign against system administrators and IT professionals. The attackers use fake job postings to lure victims into downloading a malicious version of WireGuard, a popular open-source VPN application. Once installed, the trojanized client compromises the victim's system, giving attackers access to sensitive networks and data. IT professionals are high-value targets due to their elevated privileges and access to critical infrastructure. The campaign demonstrates Sandworm's continued focus on supply chain and credential-based attacks. The group, linked to Russia's GRU military intelligence agency, has previously targeted critical infrastructure and government networks. Security researchers recommend IT professionals verify job offers through official company channels, download software only from legitimate sources, and maintain updated endpoint security tools. Organizations should implement multi-factor authentication and monitor for suspicious VPN activity.