UAC-0145 Targets Victims Through Recruitment-Themed Social Engineering

Summary

The UAC-0145 threat actor cluster is conducting advanced social engineering campaigns targeting IT professionals through job search platforms. Attackers impersonate IT companies and HR representatives to lure victims into technical interviews that involve installing malicious VPN clients. These modified WireGuard clients are designed to execute unauthorized PowerShell or shell commands after establishing a connection.

Investigation

The investigation revealed that attackers use fraudulent job offers and Zoom meetings to build trust with their targets. Victims are provided with a modified VPN client called SopraVPN, hosted on SourceForge, which uses a customized BASE64 alphabet and AES-256-GCM encryption to conceal commands. The client then triggers payload delivery through scheduled tasks on Windows or cURL commands on Linux.

Mitigation

Organizations, especially telecommunications and IT companies, should allow access to corporate resources only from managed devices. Deploying robust Endpoint Detection and Response (EDR) solutions is essential for identifying suspicious activity. Continuous endpoint monitoring and strict enforcement of managed device policies can also reduce the risk of unauthorized access from personal systems.

Response

If suspicious activity is detected, affected systems should be isolated and any VPN credentials associated with the malicious client should be revoked. Analysts should hunt for scheduled tasks involving PowerShell or cURL and investigate unusual connections to unknown VPN infrastructure. Recruitment-related communications should also be reviewed for signs of impersonation or fraudulent job offers.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The attacker aims to achieve persistence and execution via the VPN client. They modify the WireGuard configuration file to include a PostUp directive. This directive calls powershell.exe with a command line designed to mimic a custom decryption routine. To trigger the specific detection logic, the command includes the string runScriptCommand and the specific identifiers SymmetricKey and BASE64, simulating a payload that requires an AES-256-GCM key to decode.

• Regression Test Script:

  # Simulation of malicious WireGuard PostUp command execution
  # This command is crafted specifically to match the detection logic:
  # 1. Contains 'runScriptCommand'
  # 2. Contains 'SymmetricKey'
  # 3. Contains 'BASE64'
  
  $maliciousCommand = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -Command `"runScriptCommand -Payload 'A3fG9...' -SymmetricKey 'Z2VuZXJpYy1rZXk=' -Mode 'BASE64' -Algorithm 'AES256-GCM'`""
  
  Write-Host "[+] Simulating malicious VPN PostUp command..." -ForegroundColor Cyan
  Invoke-Expression $maliciousCommand
  Write-Host "[+] Simulation command executed." -ForegroundColor Green

• Cleanup Commands:

  # No persistence is actually created in this simulation script, 
  # as it only executes the command once in the current session.
  # If the script had modified a config file, we would revert it here.
  Write-Host "[+] Cleaning up simulation environment..." -ForegroundColor Yellow