SSU and FBI Reveal Ongoing Russian Cyber Espionage Campaign
The Security Service of Ukraine (SSU), in collaboration with the FBI, has exposed a persistent Russian intelligence operation aimed at infiltrating the messaging accounts of government officials, military personnel, politicians, and activists across Ukraine, Europe, and the United States. This ongoing campaign is focused on intelligence collection rather than disruption, as highlighted in an SSU alert.
The SSU's statement reveals that Russian special services are conducting systematic cyberattacks on the messaging platforms used by these individuals. The primary objective is to gain access to sensitive military, political, and economic information exchanged among users, as well as to steal personal data.
The attackers utilize low-tech methods, sending SMS messages that impersonate support bots from messaging platforms. These messages request targets to provide account credentials, confirmation codes, PINs, or recovery keys. The SSU notes that these phishing attempts are often timed for early morning hours, taking advantage of moments when targets may be less vigilant.
The operation's scope is broader than many might expect. The SSU emphasizes that Russian hackers are not only targeting organizations and public figures but also personal accounts of ordinary Ukrainians. This indicates a mass collection strategy rather than a focused elite program. High-value targets may face more sophisticated techniques, while everyday users are subjected to basic SMS impersonation tactics.
While the SSU did not attribute the campaign to a specific group, previous reports from Google, the FBI, and CISA have linked similar activities to clusters known as UNC5792 and UNC4221, both associated with FSB operations, as well as a group named Star Blizzard. An FBI advisory from June 26 revealed a significant evolution in tactics, with Russian operators shifting their focus from stealing one-time verification codes to targeting Signal Backup Recovery Keys, which provide access to an account's entire message history and remain valid even after a user creates a new account with the same phone number.
Additionally, QR codes have emerged as another method of attack. Scanning a QR code from an unknown source can silently connect the attacker's device to the victim's account, a technique previously documented by Google’s Threat Intelligence Group.
The SSU warns that the variety of tools and methods used by Russian hackers complicates defense efforts. Blocking one attack vector does not halt the campaign, as operators continuously rotate their techniques and targeting lists. To protect themselves, users are advised to regularly check active sessions in their messaging apps, enable two-factor authentication with complex alphanumeric PINs, and avoid sharing sensitive information, even if requests appear legitimate. Users should also refrain from scanning QR codes from unknown sources and report suspicious messages to the SSU’s Cybersecurity Situation Center.
