Russian Groups Target Signal Messenger in Spy Campaign

Summary: Multiple Russia-aligned threat groups are targeting the Signal Messenger application to spy on individuals involved in military and government communications related to the conflict in Ukraine. Researchers warn that the tactics employed in these attacks may inspire broader campaigns against popular messaging applications like Signal, WhatsApp, and Telegram. The activities include social engineering and phishing techniques designed to link victims’ accounts to attacker-controlled devices for message interception.

Affected: Signal Messenger, WhatsApp, Telegram

Keypoints :

• Rogue groups UNC5792 and UNC4221 are using social engineering tactics, such as fake group invitations and phishing kits, to target Signal users.
• Both groups aim to trick users into linking their accounts to malicious devices, enabling attackers to access incoming messages.
• The rise in targeting secure messaging apps indicates a growing interest from adversaries in intercepting intelligence from journalists, politicians, and military personnel.