AI Weekly Malaysia

CERT-UA reports that Russian GRU-linked Sandworm subgroup UAC-0145 has been running a fake recruitment campaign since May 2026, targeting Ukrainian IT workers and sysadmins via job sites and Telegram. The attackers impersonate recruiters from legitimate firms like Sopra Steria Bulgaria, conduct real Zoom interviews (possibly with an AI-generated persona), and trick victims into installing a malicious VPN client called 'SopraVPN' hosted on SourceForge after legitimate WireGuard configs fail.

Why: If you or your team participate in remote job interviews or technical assessments requiring VPN installations from third parties, treat any 'custom VPN client' download link as suspicious—especially when a recruiter pivots from standard tools to a SourceForge-hosted binary after a config error. The possible use of AI-generated video personas in live interviews means you can no longer assume a real person on camera validates trust.

Threat actor Head Mare exploited a vulnerability chain (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf videoconferencing servers to replace legitimate client installers with trojanized versions delivering the PhantomCore backdoor. Kaspersky detected the attacks in July 2026 targeting Russian companies across energy, transport, IT, and other sectors. The flaws allow arbitrary code execution with SYSTEM privileges on TrueConf Server versions 5.3.x through 5.5.5 and earlier, via TCP port 4307.

Why: This is a supply-chain attack pattern worth understanding: attackers compromised the update distribution mechanism of a videoconferencing platform by first exploiting server-side vulnerabilities, then replacing installer files that clients would download and trust. If you operate any self-hosted software with a client-server update mechanism, this illustrates why securing the update channel matters as much as patching the server itself. However, TrueConf is not widely used in Malaysia, so direct action is unlikely needed.