FBI: Russian hackers now target Signal backup recovery keys

1. Executive summary

The FBI and CISA have published an updated public service announcement warning that a phishing campaign attributed to Russian Intelligence Services (RIS) — publicly tracked as UNC5792 and UNC4221 — has evolved to steal Signal Backup Recovery Keys. By coercing targets into handing over their recovery key, attackers can restore the victim's encrypted backup to attacker-controlled devices, gaining access to historical private and group messages. The key remains valid after compromise: creating a new Signal account on the same phone number does not invalidate the stolen key. EMEA financial services staff — particularly those in executive, communications, government-liaison, or geopolitical-risk functions — are at risk of message-history exposure and potential follow-on social-engineering or extortion.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by the supply-chain provisions (Arts. 28–30, NIS2 Art. 21(2)(d)) as this is a social-engineering campaign against individuals, not a third-party-provider compromise.

3. Technical analysis & attack chain

Attack chain (confirmed steps from FBI/CISA PSA and BleepingComputer reporting)

1. Target selection. The campaign targets individuals of high intelligence value: current and former US and international government officials, military personnel, political figures, journalists, and key officials located in Ukraine. EMEA financial-sector staff in adjacent roles (government liaison, geopolitical risk, executive communications) should consider themselves potential targets.
2. Initial phishing message — impersonation of Signal support. Threat actors masquerade as automated Signal support accounts ("CMA support accounts"). The phishing message falsely claims Signal is introducing mandatory two-factor verification following an alleged wave of attacks by hackers from Iran and post-Soviet countries. The message instructs the target to enable backups and view their recovery key: - Settings -> Backups -> Enable backups -> View recovery key -> Copy to clipboard -> Next -> Enter the recovery key -> Next -> Continue -> Choose your backup plan - The message includes a social-engineering hook: "Not to lose your messages and media, set up your Signal Backup… Click the 'Accept' button in the pop-up and stay tuned for security updates on our messenger."
3. Backup creation. If the target follows the instructions, Signal's Secure Backups feature stores an end-to-end-encrypted copy of conversations on Signal's cloud servers. The backup is encrypted with the recovery key generated in the steps above.
4. Second phishing message — sync-issue pretext. A follow-up message, still impersonating Signal support, claims: "Your Signal Account data (messages and media) is at risk of permanent loss due to a sync issue." The target is prompted to go into Backup settings, copy the recovery key to clipboard, and paste it into the chat to prevent data loss.
5. Backup restoration on attacker device. Once the recovery key is provided, the attacker restores the backup to their own device, decrypting and accessing the victim's historical private and group conversations.
6. Persistent access. The stolen key continues to work. The FBI explicitly warns that creating a new Signal account using the same phone number does not invalidate the old stolen key. The attacker retains the ability to restore the backup.

Attribution caveat: The FBI/CISA PSA attributes the activity to Russian Intelligence Services (RIS), including officers embedded with Russia's Federal Security Service (FSB) Border Guards and other actors working on behalf of the Russian military. The campaign is publicly tracked as UNC5792 and UNC4221. However, per Adverse Trace verified reference data, "Russian intelligence services" has no MITRE ATT&CK profile — attribution is unconfirmed at the MITRE-mapped level. Treat the FBI/CISA attribution as authoritative for operational decision-making but note the formal caveat.

No CVE, no malware, no infrastructure IOCs are present in the source material. This is a pure social-engineering campaign; there is no exploited software vulnerability, no payload, no C2 infrastructure, and no file-system artefact described in the sources. The attack surface is the human operator and the Signal recovery-key workflow.

4. Mitigation & containment

P1 — Within 24 hours

• User advisory. Issue an immediate internal notice to all staff — prioritising executive, communications, government-liaison, and geopolitical-risk functions — stating:
• Signal support will never ask you to share your Backup Recovery Key.
• Do not paste your recovery key into any chat, email, or form.
• If you have shared your recovery key, assume your message history is compromised and contact the security team immediately.
• Identify potential victims. Query internal Signal usage (if discoverable via MDM or device inventory) and open a confidential reporting channel for staff who believe they may have been targeted.

P2 — Within 72 hours

• Recovery-key rotation for confirmed compromises. For any confirmed case where a recovery key was shared:
• The victim should disable backups in Signal (Settings -> Backups -> Disable backups), then re-enable backups to generate a new recovery key. Note: the FBI warns that creating a new account on the same phone number does not invalidate the old key — the old backup remains accessible to the attacker. The only remediation is to ensure no new sensitive messages are backed up under the compromised key and to treat the historical backup as permanently exposed.
• Advise the victim that historical message content is irrecoverably exposed. Assess what sensitive information was in the message history and execute breach-response playbooks accordingly.
• Signal account hardening. Enable Signal's registration lock (PIN) to prevent account re-registration by an attacker. Review linked devices (Settings -> Linked devices) and remove any unrecognised entries.

P3 — Within 7 days

• Security-awareness training update. Incorporate this specific social-engineering pattern — impersonation of messaging-app support, request for recovery keys or 2FA codes — into phishing-simulation exercises.
• Policy review. If staff use Signal for business communications, update acceptable-use and bring-your-own-device policies to address backup-recovery-key handling and the risk of message-history exposure.
• Threat-intelligence monitoring. Subscribe to FBI/CISA PSA updates on UNC5792 / UNC4221 for tactic evolution.

5. Indicators of compromise

No indicators of compromise available in the source material.

The sources describe a social-engineering campaign with no file hashes, IP addresses, domains, or malware artefacts. The phishing messages themselves are the primary artefact; their key strings are reproduced in §3 for detection and awareness purposes.

6. Detection

The sources contain distinctive phishing-message strings that can be used for YARA-based content inspection (e.g., on email or messaging gateways that inspect body text). No host-based or network-based behavioural indicators (process creation, registry, scheduled tasks) are present.

rule Signal_Phishing_RIS_Unc5792_Unc4221
{
    meta:
        author = "Adverse Trace"
        date = "2026-06-26"
        reference = "https://www.bleepingcomputer.com/news/security/fbi-russian-hackers-now-target-signal-backup-recovery-keys/"
        description = "Detects phishing-message strings used by RIS-aligned actors UNC5792/UNC4221 targeting Signal Backup Recovery Keys"
    strings:
        $s1 = "Mandatory Two-factor Verification" wide ascii
        $s2 = "Signal updates Terms of Service & Privacy Policy" wide ascii
        $s3 = "Not to lose your messages and media, set up your Signal Backup" wide ascii
        $s4 = "View recovery key" wide ascii
        $s5 = "Your Signal Account data (messages and media) is at risk of permanent loss due to a sync issue" wide ascii
        $s6 = "attacks on accounts were carried out by hackers from Iran and post-Soviet countries" wide ascii
    condition:
        2 of ($s1, $s2, $s3, $s4, $s5, $s6)
}

No Sigma rule is warranted: the sources contain no process, registry, network, or scheduled-task indicators. The attack is entirely social-engineering with no host artefact.

7. Sources

• BleepingComputer — "FBI: Russian hackers now target Signal backup recovery keys" — https://www.bleepingcomputer.com/news/security/fbi-russian-hackers-now-target-signal-backup-recovery-keys/ — 2026-06-26
• The Hacker News — "FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys" — https://thehackernews.com/2026/06/fbi-warns-russian-intelligence-hackers.html — 2026-06-26

8. Adverse Trace position

This is a medium-severity item for EMEA financial services. There is no software vulnerability to patch and no infrastructure to block — the attack surface is the human operator and the Signal recovery-key workflow. The risk to financial institutions is concentrated in staff who use Signal for sensitive communications (executive, government-liaison, geopolitical-risk, M&A, press) and who may be targeted as individuals of high intelligence value. The FBI/CISA attribution to Russian Intelligence Services is operationally authoritative but formally unconfirmed at the MITRE ATT&CK-mapped level — we note this caveat without discounting the advisory. The single most important action is an immediate user advisory: Signal support will never ask for your recovery key, and sharing it grants persistent, non-revocable access to your message history. Adverse Trace will continue to monitor FBI/CISA updates on UNC5792 and UNC4221 and will issue a follow-up note if the campaign evolves to target additional messaging platforms or introduces malware or infrastructure components.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.