Loading story…
Ukraine’s Security Service (SBU) said, in coordination with the FBI, it uncovered a long-running Russian campaign that used social engineering to compromise messaging accounts belonging to government officials, military personnel, politicians, activists, journalists, and other high-value targets in Ukraine, Europe, and the United States. According to Ukrainian and U.S. authorities, the attackers impersonated messaging-platform support teams in text and in-app messages, often contacting victims in the morning, and tricked them into handing over credentials and other sensitive account data to gain access to military, political, economic, and personal communications.
The FBI and CISA separately warned that Russian intelligence-linked operators are specifically phishing Signal Backup Recovery Keys, allowing them to restore backups, read private and group message history, and take over accounts without breaking Signal’s encryption. The updated advisory said the broader operation has already compromised thousands of accounts worldwide and is tracked publicly as UNC5792 and UNC4221, with links to multiple Russian intelligence services, including FSB-associated personnel and Russian military services. U.S. and allied agencies in the Netherlands, Germany, and France urged users to distrust messages claiming to be from Signal support, never share verification codes, PINs, or Recovery Keys, and review linked devices for unauthorized access.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The United States announced a reward of up to $10 million for information leading to the identification or location of members of the Russia-linked groups UNC5792 and UNC4221. Authorities said the groups are tied to Russian security and intelligence services and were involved in social-engineering campaigns targeting Signal and WhatsApp accounts.
The U.S. State Department’s Rewards for Justice program offered up to $10 million for information on UNC5792. The reward was cited in connection with the Russian intelligence-linked activity targeting Signal users.
The FBI and CISA updated their earlier advisory to warn that Russian intelligence-linked operators were phishing Signal users for Signal Backup Recovery Keys, enabling backup restoration, message access, and account takeover. The update said the broader campaign had already compromised thousands of accounts worldwide and identified tracking names UNC5792 and UNC4221.
A March advisory warned of a Russian intelligence-linked campaign targeting Signal users through social engineering rather than breaking the app's encryption. The activity targeted high-value individuals including government officials, military personnel, journalists, political figures, and Ukrainian officials.
Ukraine’s Security Service said, together with the FBI, it uncovered a long-running Russian campaign targeting messaging accounts of government officials, military personnel, politicians, activists, and others in Ukraine, Europe, and the United States. According to the disclosure, the operation relied primarily on social engineering, including impersonation of messaging platform support services to steal credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
itpro.com
Open sourceghacks.net
Open sourcesecurityaffairs.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcetherecord.media
Open sourceic3.gov
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Dutch intelligence and military security services (**AIVD** and **MIVD**) warned of a **large-scale Russian cyber campaign** targeting individual **Signal** and **WhatsApp** accounts—particularly those of government officials, journalists, and military personnel—by persuading victims to disclose **security verification codes** and **PINs**. The activity does **not** involve breaking end-to-end encryption or exploiting a technical vulnerability in the apps; instead, it abuses legitimate account and security workflows. One commonly observed tactic is impersonation of a *Signal Support* chatbot to solicit verification information, enabling account takeover and access to messages and group chats. The agencies also reported abuse of the apps’ **“linked devices”** functionality, where attackers attempt to attach an additional device to a victim’s account to mirror messages in real time. AIVD/MIVD assessed that the campaign has already produced victims, including within the Dutch government, and that attackers likely accessed sensitive information as a result. Separate reporting about a fake *Red Alert* Android app used to spy on Israeli users describes a different mobile-malware operation (SMS lure, sideloaded trojanized app, extensive permissions, and data exfiltration) and is not part of the Signal/WhatsApp account-takeover campaign.
Jun 29, 2026
Signal disclosed that attackers accessed limited user data after compromising Twilio through a phishing campaign against Twilio employees, exposing information tied to about 1,900 users. The intruders sought three phone numbers and re-registered one affected account, while Signal said message histories, contact lists, profile information, and other account data remained protected because the service does not store them. Signal notified impacted users and advised them to re-register their numbers and enable additional account protections. More recently, Google Threat Intelligence Group and other researchers reported that Russian state-linked actors have targeted Signal users in Ukraine through social engineering rather than by breaking Signal encryption. The most prominent tactic abuses Signal's **linked devices** feature by luring victims into scanning malicious QR codes, silently attaching an attacker-controlled device that can then receive future messages. Reporting linked activity to **Sandworm** and **UNC5792/UAC-0195**, and warned that similar QR-code and messaging-app takeover techniques are also being used against **WhatsApp** and **Telegram**, indicating a broader shift toward user-manipulation attacks on encrypted platforms.
Jun 29, 2026
A **social-engineering campaign targeting Signal and WhatsApp accounts** has hit prominent German officials and security figures, including former BND vice president **Arndt Freytag von Loringhoven**. Attackers reportedly impersonated **Signal support** and tricked victims into disclosing their PINs, enabling account compromise and follow-on abuse. In Freytag von Loringhoven’s case, the hijacked account was then used to send a malicious link to his contacts before he warned them and deleted the account. German authorities had already classified the activity as **security-relevant** and advised potential victims to check for signs such as unknown linked devices and unexpected re-registration prompts. The campaign appears to be part of a broader **espionage-focused operation** affecting politicians and officials in Germany, with investigators reportedly suspecting a connection to **Russian hybrid activity**. One additional report references the same incident only in passing while discussing a separate German cybersecurity legislative proposal, reinforcing that the compromise of the former intelligence official was one of several recent security incidents shaping the policy debate. A separate article on Frankfurt police use of a mobile facial-recognition app is **not related** to the account-takeover campaign and should be excluded.
Jun 29, 2026