The United States government has offered a reward of up to $10 million for information leading to the identification or capture of those responsible for a Russian cyberattack group that has managed to hack thousands of Signal and WhatsApp accounts. Among the victims are investigative journalists, US government employees, and military personnel.
The group, known as UNC5792 and linked to Russia’s Federal Security Service (FSB), has been using a fairly elaborate phishing technique. The attackers sent fake messages that appeared to come from Signal itself, warning users that they needed to «enable the backup» or «verify their account» to avoid losing their data. By clicking and providing their recovery key, the hackers could link a device they controlled to the victim’s account, giving them access to all new messages. The operation has compromised «thousands of accounts» since at least March of this year.
What is worrying about this attack is that it does not exploit any security flaw in Signal or WhatsApp’s encryption. The apps remain secure; the trick is deceiving people into voluntarily handing over their access keys. The State Department, through its Rewards for Justice program, warns that anyone —even security-trained professionals— can fall for this kind of deception if tired or distracted. The lesson for the average user is clear: never share your recovery key with anyone, even if the message seems to come from the official app, and if you have doubts, wait a few hours before acting.
— Marta, for intermittent intelligence.
