U.S. Offers $10 Million for Information on Groups Targeting Signal and WhatsApp Users
Summary
The U.S. State Department is offering up to $10 million for information on UNC5792 and UNC4221. Authorities say the groups used fake support messages to steal Signal backup recovery keys and access private communications.
Key points
- The State Department is offering up to $10 million for information identifying or locating UNC5792 and UNC4221 through its Rewards for Justice program.
- The U.S. announcement links UNC5792 to Russia’s FSB Border Guards and says UNC4221 works on behalf of Russian military services.
- FBI and CISA say attackers impersonated Signal support in direct messages, using a purported mandatory verification process to trick targets into revealing backup recovery keys.
- The stolen keys can give attackers access to victims’ previous Signal communications.
- U.S. authorities said the messaging platforms and their encryption were not compromised; the Rewards for Justice announcement said thousands of individual messaging-app accounts were compromised.
- Reported targets include U.S. and NATO government, diplomatic, defense, and intelligence personnel, as well as journalists, NGOs, and researchers.
- Signal users are advised that support will not ask for verification codes in the app or send links requesting account verification, recovery, or restoration.
Article Details
- Event Type
- The U.S. Department of State announced a reward of up to $10 million for information about UNC5792 and UNC4221, groups linked to Russian intelligence and military services and accused of targeting messaging-app users.
- Impact
- Phishing and fake support messages have reportedly compromised thousands of messaging-app accounts and enabled access to victims’ previous communications by stealing Signal Backup Recovery Keys. U.S. authorities said the attacks did not compromise the communication platforms or their encryption.
MITRE ATT&CK
Threat Actors
UNC4221The U.S. government describes UNC4221 as a malicious group of cyber actors working on behalf of Russian military services and links it to attacks targeting messaging-app users.UNC5792The U.S. government describes UNC5792 as a malicious cyber group associated with the Russian FSB Border Guards and attributes widespread phishing targeting Signal and WhatsApp accounts to the group.
Products
Countries
RussiaDepartment of State is offering up to $10 million for information that helps identify or locate members of the UNC5792 and UNC4221 hacker groups, which are linked to Russia’s intelligence and military services.United StatesThe U.S. Department of State is offering up to $10 million for information on UNC5792 and UNC4221, two hacker groups linked to Russian intelligence and military services.
Industries
Defenseand NATO government, diplomatic, defense, and intelligence officials, policy analysts, journalists covering Russia and Ukraine, NGOs supporting Ukraine, and security and Russian affairs researchers.GovernmentThe groups have used phishing campaigns against Signal and WhatsApp accounts of government, military, and allied personnel.intelligenceDepartment of State is offering up to $10 million for information on UNC5792 and UNC4221, two hacker groups linked to Russian intelligence and military services.MilitaryDepartment of State is offering up to $10 million for information on UNC5792 and UNC4221, two hacker groups linked to Russian intelligence and military services.