Threat Intel - Russian Hackers Target Signal and WhatsApp

The Threat

The FBI has issued a warning about phishing campaigns led by Russian hackers targeting popular messaging apps like Signal and WhatsApp. These attacks aim to compromise accounts belonging to individuals deemed of high intelligence value, such as government officials, military personnel, and journalists. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI revealed that these campaigns have led to unauthorized access to thousands of accounts worldwide.

The attackers do not exploit security flaws in the apps' encryption but instead rely on social engineering tactics. By posing as trusted contacts or services, they trick victims into providing sensitive information. This alarming trend highlights the ongoing threat posed by state-sponsored actors in the realm of cyber espionage.

Who's Behind It

While the FBI has not attributed these attacks to a specific group, prior intelligence reports have linked them to several Russian-aligned threat clusters. These include groups known as Star Blizzard, UNC5792, and UNC4221. The campaigns have been so effective that they have drawn attention from cybersecurity agencies in multiple countries, including France, Germany, and the Netherlands.

The attackers often impersonate legitimate services, such as a non-existent 'Signal Support Bot', to gain victims' trust. This strategy allows them to exploit the social dynamics of communication, making it easier to deceive individuals into revealing their login credentials.

Tactics & Techniques

The phishing campaign employs two primary methods to compromise accounts:

1. Requesting PINs or verification codes: If victims provide these, the attackers can recover the account, gaining access to messages and contact lists. Although they cannot view past messages, they can send messages as the victim, potentially conducting further phishing attacks.
2. Malicious links or QR codes: Clicking these links allows the attackers to link their devices to the victim's account, granting them access to all messages, including historical ones. In this scenario, victims retain access to their accounts unless removed from the app settings.

Defensive Measures

To protect against these phishing attacks, users should:

• Never share SMS codes or verification PINs with anyone.
• Exercise caution when receiving unexpected messages from unknown contacts.
• Verify links before clicking on them.
• Regularly review linked devices and remove any that seem suspicious.

Signal has emphasized that they will never ask for verification codes or PINs through in-app messages or social media. Staying informed and vigilant is crucial in combating these sophisticated phishing strategies. By understanding the tactics used by attackers, users can better protect their accounts and sensitive information from falling into the wrong hands.