UNC4221

UNC4221, also tracked as UAC-0185, is a Russian state-linked cyberespionage group operating on behalf of Russian military services. It targets individuals with access to sensitive government, military, political, and diplomatic information, including current and former U.S. government officials, military leaders, allied personnel, and Ukrainian officials. Its broader target set includes journalists, political figures, policy specialists, researchers, and nongovernmental organizations supporting Ukraine. The group conducts phishing and social-engineering campaigns against users of secure messaging applications, particularly Signal and WhatsApp. Operators impersonate automated support accounts and use fraudulent security, synchronization, or account-recovery warnings to solicit verification codes, account PINs, and Signal Backup Recovery Keys. The activity also abuses legitimate device-linking functionality to connect attacker-controlled devices to victims’ accounts. Successful compromise enables access to sensitive conversations, contact lists, and group communications, while hijacked accounts can support further phishing through trusted relationships. Its recovery-key phishing enables attackers to restore encrypted Signal backups on devices they control and read archived private and group conversations. Compromised recovery keys can provide continued access to backups until replaced, including when victims recreate accounts using the same telephone number. These operations compromise individual accounts through social engineering and abuse of legitimate application features rather than by breaking messaging encryption or exploiting the platforms themselves.