FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys

Summary: The FBI and CISA updated their March warning on Russian intelligence phishing of Signal accounts, adding a tactic in which operators persuade targets to hand over their Signal Backup Recovery Key, which lets the attacker restore the account backup, read private and group message history, and take over the account. The updated advisory, PSA I-062626-PSA, adds the tracking names UNC5792 and UNC4221, ties the activity to multiple Russian Intelligence Services groups including FSB officers embedded with the FSB Border Guards, and states the March notice had already reported thousands of accounts compromised worldwide.
Key Takeaway: The Recovery Key keeps working even after a target makes a new account on the same phone number, so a single pasted message can outlast the account it was meant to protect. The State Department's Rewards for Justice program is offering up to $10 million for information on UNC5792, and the targets are current and former government officials, military personnel, political figures, journalists, and officials in Ukraine.

Read the original at The Hacker News ↗