US Offers Up to $10 Million for Information on Russian-Linked Hackers
Summary
The US is offering up to $10 million for information on UNC5792 actors. CISA and the FBI warn that UNC5792 and UNC4221 are seeking messaging-app Backup Recovery Keys to access victims’ historical conversations.
Key points
- CISA and the FBI say UNC5792 and UNC4221 target US and allied officials, military leaders, journalists, and political figures.
- The groups pose as messaging-app support accounts and use phishing links or requests for verification codes to take over accounts.
- The agencies warn attackers now seek Backup Recovery Keys to access historical private and group conversations.
- Generating a new Backup Recovery Key invalidates the previous key, but does not prevent attackers from retaining an already downloaded backup.
- The US offers up to $10 million for information leading to the identification of UNC5792 actors and seeks information about their support networks, infrastructure, and finances.
Article Details
- Event Type
- The US government is offering rewards of up to $10 million for information identifying individuals associated with UNC5792, while CISA and the FBI report that the groups’ phishing tactics against commercial messaging applications have evolved.
- Impact
- The actors reportedly use social engineering and legitimate device-linking features to take over messaging accounts and access sensitive communications, contacts, and group conversations. They now seek Backup Recovery Keys to access historical conversations; a compromised key may remain valid after an account is recreated with the same phone number. Compromised accounts have also been used to phish other targets. CISA and the FBI warn that resetting the key does not prevent access to backups already downloaded.
MITRE ATT&CK
Threat Actors
UNC4221CISA and the FBI associate UNC4221 with Russian intelligence services. The US Rewards for Justice portal links it to the Russian military services. The group is reported to target officials and other individuals through phishing and messaging-account takeover tactics.UNC5792CISA and the FBI associate UNC5792 with Russian intelligence services. The US Rewards for Justice portal links it to the Russian Federal Security Service (FSB) Border Guards. The group is reported to target officials and other individuals through phishing and messaging-account takeover tactics.
Products
SignalPosing as automated CMA support accounts, the hackers lure victims into clicking on a link or sharing verification codes to take over their accounts on messaging platforms such as Signal and WhatsApp.WhatsAppPosing as automated CMA support accounts, the hackers lure victims into clicking on a link or sharing verification codes to take over their accounts on messaging platforms such as Signal and WhatsApp.
Countries
RussiaRelated: Russia-Linked ‘GreyVibe’ Attackers Use AI to Supercharge CyberattacksUkraineand military leaders, allied personnel, journalists, political figures, and key officials located in Ukraine.United StatesThe US government is offering rewards of up to $10 million for information on individuals associated with two threat actors linked to Russian intelligence.
Industries
GovernmentThe US government is offering rewards of up to $10 million for information on individuals associated with two threat actors linked to Russian intelligence.MilitaryUNC5792 and UNC4221, the cyber groups have been targeting current and former US government officials and military leaders, allied personnel, journalists, political figures, and key officials located in Ukraine.