U.S. Offers $10 Million Reward for Information on Groups Targeting Signal and WhatsApp Accounts
Summary
The U.S. is offering up to $10 million for information on Russia-linked groups UNC5792 and UNC4221. The FBI says they use social engineering to steal messaging-account credentials and backup recovery keys.
Key points
- The State Department’s Rewards for Justice program is offering up to $10 million for information leading to the identification or location of members of UNC5792 and UNC4221.
- U.S. authorities say the groups are associated with Russian security and intelligence services.
- The FBI says the campaign targets individual Signal and WhatsApp accounts rather than exploiting vulnerabilities in the apps.
- Attackers reportedly use social engineering to obtain verification codes, account PINs, and backup recovery keys.
- The FBI warned that stolen backup recovery keys may allow attackers to regain access even after victims create new accounts with the same phone number.
- In some cases, attackers reportedly altered legitimate Signal group invitation pages to direct victims to malicious links.
- Ukraine’s SBU said it worked with the FBI to uncover a related espionage campaign targeting messaging accounts across Ukraine, Europe, and the United States.
Article Details
- Event Type
- U.S. reward announcement and FBI warning concerning cyber-espionage campaigns attributed to the Russia-linked groups UNC5792 and UNC4221.
- Impact
- The groups are accused of targeting Signal and WhatsApp accounts used by government officials, military personnel, politicians, journalists, activists, and other high-profile individuals. Social engineering to obtain verification codes, account PINs, and backup recovery keys can enable access to message histories and private or group chats, account takeover, and possible future access using compromised recovery keys. The SBU said the broader campaign sought sensitive military, political, and economic information and victims’ personal data.
Threat Actors
UNC4221U.S. authorities accuse UNC4221 of targeting Signal and WhatsApp accounts in espionage campaigns using social engineering to obtain account credentials and recovery information. Authorities associate the group with Russia’s Border Guards and military intelligence; this is an attributed claim, not independently confirmed in the article.UNC5792U.S. authorities accuse UNC5792 of targeting Signal and WhatsApp accounts in espionage campaigns using social engineering to obtain account credentials and recovery information. Authorities associate the group with Russia’s Federal Security Service (FSB); this is an attributed claim, not independently confirmed in the article.
Products
Signalmillion for information on members of UNC5792 and UNC4221, two Russia-linked groups accused of targeting Signal and WhatsApp accounts used by officials, journalists, and other high-profile figures.WhatsAppinformation on members of UNC5792 and UNC4221, two Russia-linked groups accused of targeting Signal and WhatsApp accounts used by officials, journalists, and other high-profile figures.
Countries
RussiaThe United States is offering up to $10 million for information on members of UNC5792 and UNC4221, two Russia-linked groups accused of targeting Signal and WhatsApp accounts used by officials, journalists, and otherUkraineThe FBI says the campaign relies on social engineering to steal verification codes, PINs, and backup recovery keys, while Ukraine’s SBU says it helped expose a related long-running espionage operation with the FBI.United StatesThe United States is offering up to $10 million for information on members of UNC5792 and UNC4221, two Russia-linked groups accused of targeting Signal and WhatsApp accounts used by officials, journalists, and other