FBI Warns of Russian Hackers Targeting Signal Backup Recovery Keys
The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have alerted the public to a phishing campaign targeting Signal users, attributed to Russian intelligence services. This updated warning highlights a shift in tactics, as attackers now aim to steal Backup Recovery Keys, which can grant access to users' historical messages. Previously, the focus was on hijacking accounts through phishing messages designed to capture verification codes or account PINs.
The campaign, tracked as UNC5792 and UNC4221, continues to target individuals deemed of high intelligence value, including current and former government officials, military personnel, political figures, and journalists, particularly those located in Ukraine. The FBI's public service announcement emphasizes that these cyber threat actors impersonate Signal support teams, sending messages that falsely claim the introduction of mandatory two-factor verification due to alleged attacks from hackers in Iran and post-Soviet countries.
In these phishing messages, users are misled into believing they must set up their Signal Backup to avoid losing messages and media. The instructions provided in these messages guide users to enable backups and copy their recovery key, which is crucial for restoring backed-up data. However, once users share their recovery key, attackers can use it to access the victims' messages on their own devices.
The phishing campaign has evolved to include follow-up messages warning users of potential data loss due to synchronization issues, further prompting them to share their recovery keys. The FBI warns that if an attacker obtains a user's Backup Recovery Key, simply creating a new Signal account with the same phone number does not invalidate the old key. Users must generate a new Backup Recovery Key through Signal's backup settings to protect their data, but this does not prevent attackers from accessing previously downloaded backups.
The advisory reminds users that legitimate support teams will only communicate through official channels and will never request sensitive information like verification codes or recovery keys. Anyone who suspects they have fallen victim to this campaign is urged to report the incident to the FBI's Internet Crime Complaint Center (IC3) or their local FBI field office.
