FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys

The FBI and CISA have updated their March warning about Russian intelligence phishing Signal accounts, adding a new tactic where attackers coax targets into handing over their Signal Backup Recovery Key. Once obtained, the attacker can restore the account’s backup, read private and group message history, and take over the account. The key remains active even if the user creates a new account with the same phone number. The advisory recommends generating a new key in Settings to invalidate the old one, though any data already extracted is compromised.

The updated advisory (PSA I-062626-PSA) adds tracking names UNC5792 and UNC4221, linking the activity to multiple Russian Intelligence Services (RIS) groups, including FSB officers and Russian military personnel. The campaign targets Signal and WhatsApp accounts, with the recovery-key tactic specific to Signal. Targets include current and former U.S. and international government officials, military personnel, political figures, journalists, and officials in Ukraine. The March notice indicated thousands of accounts had already been compromised worldwide.

The phishing messages pose as Signal support, asking for SMS verification codes, account PINs, or doctored group invite links. The updated version walks targets through enabling Signal backups and pasting the Recovery Key into the chat. The advisory provides sample messages disguised as mandatory two-factor rollout or urgent data recovery. The agencies emphasize that Signal’s encryption remains intact; the compromise occurs through social engineering.

The State Department’s Rewards for Justice program offers up to $10 million for information on UNC5792. The activity overlaps with warnings from Dutch, German, and French intelligence agencies. Google’s Threat Intelligence Group first documented UNC5792 abusing Signal’s linked-device feature in early 2025, with similar tactics used against WhatsApp and Telegram.

Users should treat any in-app message from ‘Signal support’ as hostile, never share verification codes, PINs, or Recovery Keys, check Linked Devices for unrecognized entries, and generate a new Recovery Key if compromised.