Key facts
- US authorities are offering up to $10 million for information on a Russian state cyber group.
- The group has compromised thousands of Signal and WhatsApp accounts.
- Targets include investigative reporters and US government employees.
- The hacking campaign has been active since at least March.
- The FBI identified two responsible Russian government groups as UNC5792 and UNC4221.
- Attackers use phishing tactics, including impersonating support bots and requesting encryption passcodes.
US federal authorities are offering a reward of up to $10 million for information that leads to the identification or location of a Russian state cyber group responsible for hacking thousands of Signal and WhatsApp accounts. The targets of these attacks include investigative reporters and US government employees.
The campaign has been active since at least March, when the FBI issued an advisory warning about phishing efforts by attackers associated with Russian intelligence services. These attackers impersonate automated support communications, prompting targets to click links or provide verification codes and account passcodes. Compliance with these requests can lead to the attacker's device being linked to the user's account or a complete account takeover, locking the user out.
Once an account is compromised, attackers can read new messages. Signal's safety features prevent access to previous conversations unless users are tricked into providing encryption passcodes for backups. The FBI's recent update indicated that the campaign has evolved, with messages now urging users to create backups and then share the long passcode used to encrypt these backups stored on Signal servers. This allows attackers access to past conversations.
The FBI identified two Russian government groups, UNC5792 and UNC4221, as being responsible for these attacks. The agency also noted that hackers from Iran and post-Soviet countries are involved. One example message provided by the FBI mimics a Signal security update, informing users of increased hacking attempts and the introduction of mandatory two-factor verification, while guiding them through a backup process that ultimately compromises their account.