U.S. State Department Issues $10M Bounty Targeting UNC5792 and UNC4221 via Signal and WhatsApp Phishing Campaigns
The U.S. Department of State has announced a $10 million reward for actionable intelligence identifying Russian-linked threat actors UNC5792 and UNC4221. These actors focus on bypassing end-to-end encryption (E2EE) on Signal and WhatsApp through sophisticated account takeover (ATO) workflows. By utilizing advanced social engineering, credential harvesting, and session hijacking, the groups compromise mobile identities of high-value targets, including military and diplomatic personnel. The campaign targets the application layer to circumvent cryptographic protections, facilitating large-scale intelligence exfiltration from mobile endpoints. This shift toward identity-centric exploitation bypasses traditional network perimeter defenses, necessitating enhanced hardware-backed authentication and mobile-specific threat intelligence.