English • 2h
Russian Intelligence Campaign Targeting Signal and WhatsApp Backup Recovery Keys
Russian intelligence services, tracked as unc5792, are conducting a long-running cyber espionage campaign targeting Signal and WhatsApp users to bypass end-to-end encryption. The operation specifically targets high-value individuals in government, military, and political sectors across Ukraine, the EU, and the US. Instead of direct protocol exploits, attackers utilize sophisticated social engineering—impersonating technical support personnel—to manipulate targets into surrendering Signal Backup Recovery Keys. This allows for complete account takeover and access to encrypted message histories, facilitating large-scale intelligence gathering and operational espionage against state and non-state actors.