Sandworm lures IT admins with trojanized WireGuard VPN
Sandworm’s UAC‑0145 cluster pretends to recruit system admins, moving conversations to Telegram and Zoom before sending a tampered WireGuard client. The client decodes a hidden AES key, runs a PowerShell script that creates a scheduled task and pulls a second‑stage payload, turning a fake VPN test into a malware drop.