Cybersecurity
US puts $10M bounty on Russian hacking group targeting journalists and government officials
Federal authorities are hunting a Russian state-linked cyber group that has compromised thousands of Signal and WhatsApp accounts used by high-level targets.
Ars Technica
The U.S. government is offering a substantial financial reward to help dismantle a Russian state-sponsored operation that has successfully infiltrated encrypted messaging accounts belonging to sensitive figures. The $10 million bounty targets individuals or entities who can provide actionable intelligence on the group's identity and whereabouts.
The campaign, which involves credential theft and account takeovers affecting thousands of users, has focused on high-priority victims: current and former government officials, military personnel, elected officials, and investigative journalists. Since March, the FBI has tracked escalating sophistication in the attacks.
How the attacks work#
The operation relies on deceptive messaging to lure targets into compromising their own security. Phishing messages are crafted to impersonate automated alerts from Signal or WhatsApp, asking recipients to click links or share verification codes and account passwords. When victims comply, attackers either link the user's account to a device they control or seize full account access.
The initial compromise alone allows the adversary to read incoming messages. However, Signal's architecture includes a protective measure: prior conversations remain encrypted and inaccessible to unauthorized device additions.
Escalating tactics#
The attackers have become more cunning over time. A recent FBI alert published last week documented an evolution in their methods. Beyond account-linking tricks, they now impersonate support services urging users to back up their message history—a seemingly routine security practice that actually unknowingly exposes encryption keys.
The follow-up message in this social engineering chain requests the long recovery passcode that protects backups stored on Signal's servers. With this credential, attackers gain retroactive access to previously encrypted conversations that were initially inaccessible.
The FBI has attributed the operation to two tracked adversary groups: UNC5792 and UNC4221, both assessed as Russian government entities.
What's at stake#
The targeting of journalists and government staff suggests intelligence-gathering motivations. The initial March advisory flagged that the operation was already widespread when authorities issued their warning, indicating thousands had already fallen victim.
