Russian APTs Target Signal Messenger Backup Recovery Keys for Account Takeover
Russian state-sponsored APTs are conducting targeted phishing campaigns to harvest Signal Messenger backup recovery keys, bypassing established end-to-end encryption (E2EE) protocols. By utilizing sophisticated social engineering lures masquerading as official security alerts, actors target high-value demographics—specifically journalists and political activists—to facilitate complete account takeover (ATO). Once recovery keys are obtained, attackers can migrate accounts and decrypt historical chat backups stored in the cloud. The US government has signaled the severity of this intelligence-led campaign by offering a $10 million reward for information identifying the responsible actors, highlighting a pivot from protocol exploitation to targeting the human-centric recovery mechanism.
Russian State-Sponsored Campaign Targeting Signal Messenger Accounts
Russian state-sponsored threat actors have launched a targeted campaign to hijack Signal Messenger accounts by exploiting vulnerabilities in the Public Switched Telephone Network (PSTN) rather than the application's encryption. This shift toward identity-layer exploitation demonstrates a sophisticated strategic pivot to bypass End-to-End Encryption (E2EE) by compromising the telephony-based authentication process used for account registration.