Russian intelligence-associated cybercriminals are actively attempting to gain control over Signal accounts by masquerading as support personnel to solicit backup recovery keys from unsuspecting users. This ongoing campaign predominantly targets individuals engaged in confidential discussions, including government officials, military members, politicians, journalists, and leaders within Ukraine.
Phishing Tactics Targeting Sensitive Users
The operation relies on misleading tactics rather than exploiting Signal’s robust end-to-end encryption. Victims are deceived into believing that their chats, media, or account data are at risk of disappearing due to alleged synchronization issues. Attackers then guide users through backup settings, instructing them to copy and paste their recovery key into a chat.
The Federal Bureau of Investigation (FBI) has attributed these phishing activities to multiple clusters of Russian Intelligence Services, which are orchestrating these attacks against high-profile targets. The compromised backup data becomes a valuable asset, allowing hackers to access past private and group messages before fully taking over the account.
Ongoing Threats and Vulnerabilities
Despite individual accounts being compromised, the Signal application and its encryption remain unaffected. The Russian Federal Security Service and associated military services are believed to be involved in these activities, tracked as UNC5792 and UNC4221, continuing a trend observed in previous phishing incidents.
The FBI has warned that these operations are still active and require vigilance from the targeted communities. The attackers impersonate automated support within the app, using professional language to pressure victims into quick action. The focus on backup recovery keys is particularly concerning, as they can grant access to archived content otherwise inaccessible to the attackers.
Steps to Protect Your Signal Account
Users receiving unexpected account warnings should disregard any instructions within the message, even if it seems authentic. Genuine support channels do not request verification codes or recovery keys within the app. The FBI and CISA recommend treating unsolicited alerts with skepticism.
Individuals who may have shared their recovery key should generate a new one immediately to prevent further exposure. They should also review account activities, change related credentials, and report the incident to the appropriate authorities. Organizations should educate high-risk employees about the dangers of phishing and the importance of maintaining cautious communication practices.
The ongoing threat highlights the critical need for awareness and proactive measures to safeguard sensitive communications. The implications of these attacks extend beyond individual privacy, posing risks to operational integrity and safety.
.webp?ssl=1 "Iranian Cyber Campaign Uses Multiple Hacker Personas")