Security Affairs • 1h
Russian Intelligence Campaign Targeting Signal and WhatsApp Backup Recovery Keys
Russian intelligence services are executing a systematic cyber-espionage campaign targeting government and military personnel across Ukraine, Europe, and the United States. The actors bypass end-to-end encryption (E2EE) in Signal and WhatsApp not by breaking the cryptography, but by utilizing social engineering and phishing to steal backup recovery keys. By obtaining these keys, attackers can restore chat histories and access sensitive communications on new devices. This campaign, linked to threat actor UNC5792, demonstrates a strategic shift toward targeting account recovery mechanisms to circumvent robust platform security architectures.