FBI and CISA Warn of Russian-Linked Phishing Targeting Signal Backup Keys
Summary
FBI and CISA say Russian intelligence-linked actors are impersonating Signal support to steal backup recovery keys, which could expose historical messages. Users who shared a key should generate a new one; this cannot block access to backups already downloaded.
Key points
- FBI and CISA attribute the campaign to Russian Intelligence Services; it is tracked as UNC5792 and UNC4221.
- The actors impersonate Signal support and use fake security and synchronization warnings to trick users into sharing backup recovery keys.
- A stolen key can let attackers restore a victim's encrypted backup on their own devices and read historical private and group messages.
- Creating a new Signal account with the same phone number does not invalidate a stolen key; users must generate a new recovery key in backup settings.
- Generating a new key prevents future downloads with the old key, but cannot block access to backups attackers have already downloaded.
- The agencies advise reporting suspected victimization to IC3, an FBI field office, or CISA.
Article Details
- Event Type
- FBI and CISA warning about an evolving phishing campaign targeting Signal users.
- Impact
- Attackers impersonate Signal support to steal Backup Recovery Keys. A stolen key can let them restore a victim’s backup on another device and access historical private and group messages; changing the key does not prevent access to backups already downloaded.
MITRE ATT&CK
Threat Actors
Russian Intelligence ServicesThe FBI and CISA attribute the phishing campaign targeting Signal users to Russian Intelligence Services.UNC4221Publicly tracked as involved in the phishing campaign targeting Signal users, which the agencies attribute to Russian Intelligence Services.UNC5792Publicly tracked as involved in the phishing campaign targeting Signal users, which the agencies attribute to Russian Intelligence Services.
Products
Countries
Russiaagencies attribute the activity to Russian Intelligence Services (RIS), including officers embedded with Russia’s Federal Security Service (FSB) Border Guards and other actors working on behalf of the Russian military.Ukrainegovernment officials, military personnel, political figures, journalists, and key officials located in Ukraine.United States“An investigation conducted jointly with the US government and European partners revealed that the attacks on accounts were carried out by hackers from Iran and post-Soviet countries.
Industries
Governmentto target individuals of high intelligence value, including current and former US and international government officials, military personnel, political figures, journalists, and key officials located in Ukraine.Media“Not to lose your messages and media, set up your Signal Backup (Settings -> Backups -> Enable backups -> View recovery key -> Copy to clipboard -> Next -> Enter the recovery key -> Next -> Continue -> Choose yourMilitaryof high intelligence value, including current and former US and international government officials, military personnel, political figures, journalists, and key officials located in Ukraine.