FlagThis — Daily Cybersecurity Intelligence Briefing

Russian state-sponsored threat actors have launched a targeted campaign to hijack Signal Messenger accounts by exploiting vulnerabilities in the Public Switched Telephone Network (PSTN) rather than the application's encryption. This shift toward identity-layer exploitation demonstrates a sophisticated strategic pivot to bypass End-to-End Encryption (E2EE) by compromising the telephony-based authentication process used for account registration.

The U.S. Department of State has announced a $10 million reward for actionable intelligence identifying Russian-linked threat actors UNC5792 and UNC4221. These actors focus on bypassing end-to-end encryption (E2EE) on Signal and WhatsApp through sophisticated account takeover (ATO) workflows. By utilizing advanced social engineering, credential harvesting, and session hijacking, the groups compromise mobile identities of high-value targets, including military and diplomatic personnel. The campaign targets the application layer to circumvent cryptographic protections, facilitating large-scale intelligence exfiltration from mobile endpoints. This shift toward identity-centric exploitation bypasses traditional network perimeter defenses, necessitating enhanced hardware-backed authentication and mobile-specific threat intelligence.

Nation-state actors, including Iranian and Russian-linked groups, are increasingly leveraging mainstream communication platforms—specifically Telegram, Discord, and Signal—to facilitate Command and Control (C2) operations and malware delivery. By utilizing these high-reputation SaaS applications, attackers mask malicious traffic within legitimate, high-volume encrypted streams, effectively bypassing traditional Network Detection and Response (NDR) and Endpoint Detection and Response (EDR) solutions. Technical implementations include the Rust-based ChaosBot malware, which utilizes Discord’s API for corporate espionage, and various Telegram-integrated payloads. This tactical shift enables persistent C2 channels, facilitates intellectual property theft, and supports targeted surveillance of dissidents through the exploitation of trusted third-party infrastructures.