Google said that while these recent attacks were likely driven by wartime demands to access sensitive government and military communications in the context of Russia’s invasion of Ukraine, researchers expect attacks on Signal to grow and spread to additional threat actors and regions. Russian state-backed hackers are increasingly targeting Signal messenger accounts — including those used by Ukrainian military personnel and government officials — in an effort to access sensitive information that could aid Moscow’s war effort, researchers warn. However, Google has also discovered a campaign in which the notorious Russian threat actor Sandworm assisted Russian military forces in linking Signal accounts from captured battlefield devices to their own systems for further exploitation. Russian hackers typically distribute these malicious QR codes remotely, disguising them as legitimate Signal group invites or security alerts, or embedding them in phishing pages that imitate websites used by the Ukrainian military. Google has observed similar techniques used by Russian threat actors in attacks on Ukrainian Signal users. Another Russian threat actor, tracked as UNC4221, developed a tailored Signal phishing kit that mimics the Kropyva application used by the Ukrainian armed forces for artillery guidance. In addition to linking hacker-controlled devices to victims’ Signal accounts, multiple well-established regional threat actors have also been stealing Signal database files from Android and Windows devices. “We expect secure messages and location data to frequently feature as joint targets in future operations of this nature, particularly in the context of targeted surveillance operations or support for conventional military operations,” the researchers said. The latest Signal releases for Android and iOS, for example, contain enhanced security features designed to help protect against similar phishing campaigns in the future, researchers said. Another Russian threat actor, Turla, has used a PowerShell script to exfiltrate Signal desktop messages. Ukrainian state cybersecurity officials have previously warned that Russian hacker groups actively exploit Signal to attack government and defense officials.
This Cyber News was published on therecord.media. Publication date: Wed, 19 Feb 2025 14:45:09 +0000