UNC5792

UNC5792, also tracked as UAC-0195, is a Russia-based cyberespionage threat actor associated with the Russian Federal Security Service (FSB) Border Guards. It targets Signal and WhatsApp accounts belonging to U.S. government officials, military leaders, Ukrainian officials, and allied diplomatic, intelligence, and defense personnel. Its broader targets include policy analysts, investigative journalists covering Russia and Ukraine, nongovernmental organizations supporting Ukraine, and academic researchers specializing in security studies and Russian affairs. The group uses phishing and social engineering to abuse legitimate messaging application features rather than exploit software vulnerabilities or defeat end-to-end encryption. Its techniques include deceptive Signal group invitations and modified invitation pages that induce victims to link attacker-controlled devices to their accounts. This provides access to sensitive communications, contact lists, and group conversations while potentially allowing the compromise to remain unnoticed. Compromised accounts are subsequently used to impersonate trusted contacts and conduct additional phishing. UNC5792 also impersonates messaging application support accounts to solicit verification codes, account PINs, and Signal Backup Recovery Keys. Recovery-key theft enables attackers to restore victims’ encrypted backups on devices they control and obtain historical private and group conversations. The group has additionally used AI models to analyze Telegram channels for information of interest to Russian authorities, including security threats and extremist content. UNC4221 is a separate Russian intelligence-linked cluster involved in related messaging-account phishing activity, not an alias of UNC5792.