FBI Warns of Sophisticated Russian Hacking Campaign Targeting Secure Messaging Apps

The FBI and CISA have issued an updated warning about a Russian intelligence hacking campaign that targets secure messaging apps, including Signal and WhatsApp. The campaign, which has already compromised thousands of accounts worldwide, involves phishing attacks that trick users into handing over their Signal Backup Recovery Key. This key allows attackers to restore account backups, read private and group message history, and take over the account. The FBI has tied the activity to multiple Russian Intelligence Services groups, including the FSB and Russian military services.

The targets of the campaign include high-value individuals such as current and former government officials, military personnel, politicians, journalists, and officials in Ukraine. The phishing messages pose as Signal support and walk the target through the process of turning on Signal backups and sharing the Recovery Key. To protect themselves, users are advised to treat any in-app message from Signal support as hostile, never share their Backup Recovery Key or verification code, and regularly check their linked devices for any unrecognized entries. The FBI and CISA emphasize that the hacking campaign does not compromise Signal's encryption, but rather exploits individual account vulnerabilities through social engineering.

The State Department's Rewards for Justice program is offering up to $10 million for information on the hacking group, UNC5792. Users who believe they may have handed over their Recovery Key are advised to generate a new one immediately and assume any previous backups are already in the hands of the attackers.

Source: The Hackers News