Loading story…
Russia's Federal Security Service (FSB) said it uncovered a large-scale espionage operation in which malware was implanted on the smartphones of senior Russian government officials. According to the agency, the spyware enabled theft of correspondence, call data, geolocation, contact lists, and other stored information, while also allowing interception of conversations and covert activation of device microphones and cameras for audio and video collection.
Russian authorities said they opened a criminal investigation into illegal access to computer information and malware distribution and are conducting forensic analysis to identify the perpetrators, map the supporting infrastructure, and determine the scope of the compromise. The FSB did not publish technical evidence, name the malware, disclose victim counts, or specify the infection vector, though reporting said infrastructure linked to Cloudflare and Fastly appeared in footage released by the agency without accusing either company of direct involvement; the allegations also echo Russia's earlier claims around the Operation Triangulation iPhone spyware campaign.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Russian authorities said they opened a criminal investigation into the alleged compromise of officials' smartphones. According to the reports, the probe is intended to identify the perpetrators, map the infrastructure involved, assess the scope of the compromise, and examine affected devices.
Russia's Federal Security Service said it uncovered a large-scale espionage campaign in which malware was implanted on mobile devices used by senior or high-ranking Russian officials. The agency said the spyware enabled theft of correspondence and stored data, interception of calls and communications, geolocation and contact-list access, and covert audio/video collection, but it did not provide technical evidence or identify the malware.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcexakep.ru
Open sourcecybersecuritynews.com
Open sourcetheregister.com
Open sourcefsb.ru
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed **Operation Triangulation**, an iPhone espionage campaign that infected devices through iMessage and deployed a sophisticated spyware implant on iOS. Reporting tied the operation to a chain of **four zero-day vulnerabilities**, including flaws in Apple’s processing of messages and a hardware-based feature that enabled attackers to bypass protections that were largely undocumented outside Apple. Kaspersky said the malware targeted iPhones used by its employees, while later technical analysis and conference presentations detailed how the implant gained code execution, escalated privileges, and maintained stealth on compromised devices. The campaign quickly drew geopolitical attention after Russian authorities accused Apple of cooperating with the **NSA** in the spying operation, an allegation that was widely reported but not substantiated by public technical evidence. Subsequent coverage focused on the exploit kit sometimes referred to as **Coruna**, with Kaspersky later saying it had found **no signs** that the toolkit was created by the United States. The case remains notable for showing that attackers combined multiple iOS zero-days with obscure Apple hardware behavior to build a highly advanced surveillance platform against iPhone users.
Jul 12, 2026
The Dutch intelligence and military security services (**AIVD** and **MIVD**) warned of a **large-scale Russian cyber campaign** targeting individual **Signal** and **WhatsApp** accounts—particularly those of government officials, journalists, and military personnel—by persuading victims to disclose **security verification codes** and **PINs**. The activity does **not** involve breaking end-to-end encryption or exploiting a technical vulnerability in the apps; instead, it abuses legitimate account and security workflows. One commonly observed tactic is impersonation of a *Signal Support* chatbot to solicit verification information, enabling account takeover and access to messages and group chats. The agencies also reported abuse of the apps’ **“linked devices”** functionality, where attackers attempt to attach an additional device to a victim’s account to mirror messages in real time. AIVD/MIVD assessed that the campaign has already produced victims, including within the Dutch government, and that attackers likely accessed sensitive information as a result. Separate reporting about a fake *Red Alert* Android app used to spy on Israeli users describes a different mobile-malware operation (SMS lure, sideloaded trojanized app, extensive permissions, and data exfiltration) and is not part of the Signal/WhatsApp account-takeover campaign.
Jun 29, 2026
Ukraine’s Security Service (**SBU**) said, in coordination with the **FBI**, it uncovered a long-running Russian campaign that used social engineering to compromise messaging accounts belonging to government officials, military personnel, politicians, activists, journalists, and other high-value targets in Ukraine, Europe, and the United States. According to Ukrainian and U.S. authorities, the attackers impersonated messaging-platform support teams in text and in-app messages, often contacting victims in the morning, and tricked them into handing over credentials and other sensitive account data to gain access to military, political, economic, and personal communications. The **FBI** and **CISA** separately warned that Russian intelligence-linked operators are specifically phishing **Signal Backup Recovery Keys**, allowing them to restore backups, read private and group message history, and take over accounts without breaking Signal’s encryption. The updated advisory said the broader operation has already compromised thousands of accounts worldwide and is tracked publicly as **`UNC5792`** and **`UNC4221`**, with links to multiple Russian intelligence services, including **FSB**-associated personnel and Russian military services. U.S. and allied agencies in the Netherlands, Germany, and France urged users to distrust messages claiming to be from Signal support, never share verification codes, PINs, or Recovery Keys, and review linked devices for unauthorized access.
Jun 30, 2026