FBI Warns of Russian and Iranian Campaigns Targeting Messaging Apps
Summary
The FBI and CISA warned that Russian actors are phishing users to take over Signal accounts, while an FBI alert linked Iran’s MOIS and Handala Hack to Telegram-connected malware used to monitor targets and exfiltrate files.
Key points
- The FBI and CISA said Russian actors use fake support messages to obtain verification codes or PINs, or persuade users to add an attacker-controlled linked device.
- The agencies said the campaign resulted in unauthorized access to thousands of accounts, including those of U.S. officials, military personnel, political figures, and journalists.
- The FBI said the approach could apply to any messaging app and targets users rather than exploiting a flaw in Signal or its encryption.
- A separate FBI alert described Iran’s MOIS using Telegram bots as command-and-control infrastructure for malware targeting dissidents, journalists, and others.
- The malware was disguised as programs including Pictory, KeePass, or Telegram; in some cases, attackers reportedly used social messaging and fake technical support to deliver it.
- The FBI advisory said the malware could capture screens and audio, collect files, and enable remote access; stage-one malware appeared tailored to victims after likely reconnaissance.
- A quoted security executive recommended logging, anomaly detection, and stricter access policies for sanctioned messaging apps.
Article Details
- Event Type
- The FBI and CISA warned of separate Russian and Iranian cyber campaigns involving messaging platforms: phishing to compromise Signal accounts and malware using Telegram for command and control.
- Impact
- The agencies reported unauthorized access to thousands of accounts. The Iranian campaign’s malware could enable screen and audio capture, file exfiltration, surveillance, and remote access to infected devices.
MITRE ATT&CK
T1036 · MasqueradingIranian actors disguised malware as legitimate programs or services, including Pictory, KeePass, and Telegram.T1041 · Exfiltration Over C2 ChannelThe Telegram bots enabled exfiltration of screen captures and files from victim devices.T1102.002 · Bidirectional CommunicationThe article says compromised devices communicated with Telegram bots that enabled bidirectional communication and remote access.T1113 · Screen CaptureThe Iranian malware enabled screen capture.T1125 · Video CaptureThe Iranian malware enabled audio recording.T1566 · PhishingRussian actors used phishing messages posing as automated support notices to obtain account access.
People
Threat Actors
Products
KeePassIran’s MOIS and the group Handala Hack used Telegram as command-and-control for malware disguised as legitimate apps like Pictory or KeePass.PictoryIran’s MOIS and the group Handala Hack used Telegram as command-and-control for malware disguised as legitimate apps like Pictory or KeePass.Signalplatforms to compromise accounts and deploy malware, with Russian actors using phishing to hijack Signal accounts and Iranian actors using Telegram-linked malware attributed to Handala Hack.Telegramdeploy malware, with Russian actors using phishing to hijack Signal accounts and Iranian actors using Telegram-linked malware attributed to Handala Hack.
Countries
IranIran’s MOIS and the group Handala Hack used Telegram as command-and-control for malware disguised as legitimate apps like Pictory or KeePass.RussiaRussia’s intelligence services are allegedly targeting commercial applications like Signal, compromising the accounts of current and former U.S.United StatesThe campaign has compromised thousands of accounts, targeting U.S.