State-backed hackers targeted EU officials on WhatsApp, document shows

Key facts

• Foreign governments are targeting high-ranking EU officials' messaging accounts, according to an internal EU cyber defense unit presentation.
• The attacks are characterized as "state-sponsored spearphishing" using social engineering techniques and personalized lures.
• This is the first official acknowledgment by an EU authority linking such attacks to foreign governments.
• National cyber agencies have previously warned about hacking campaigns on Signal and WhatsApp, with Dutch intelligence specifically linking them to Russia.
• The EU institutions have faced eight "significant incidents" this year, with challenges in common cybersecurity solutions.

Foreign governments are actively attempting to hack the messaging accounts of high-ranking European Union officials, according to an internal presentation from the bloc's cyber defense unit obtained by POLITICO. The presentation, shared with officials from EU national governments in July, identifies "account takeover targeting high-ranking officials" as a significant threat for the current year.

This marks the first official acknowledgment by an EU authority that its officials have been targeted through messaging apps, following earlier warnings from national cyber agencies about campaigns linked to Russian threat groups. The attacks are described as "state-sponsored spearphishing," employing social engineering techniques and personalized messages to trick targets into clicking malicious links or opening harmful attachments.

Earlier reports indicated that the European Commission had advised some senior officials to cease using a Signal group due to hacking concerns. This aligns with warnings from national cyber and intelligence agencies advising governments to avoid commercial messaging apps like WhatsApp and Signal for official communications. In March, at least five national agencies publicly cautioned about ongoing hacking efforts on Signal and WhatsApp, with Dutch intelligence specifically attributing these to Russia. Germany had also warned that hackers were targeting prominent individuals in politics, military, and diplomacy, as well as investigative journalists, sometimes posing as fake Signal support chatbots to obtain verification codes.

EU cybersecurity officials highlighted in the presentation that the bloc's institutions have experienced eight "significant incidents" so far this year. A key challenge identified is the disparity in technical cybersecurity solutions across different EU institutions, leading to a lack of a unified system for exchanging sensitive and classified documents. The European Commission declined to provide specific details regarding internal security practices when questioned about the presentation.