US Offers $10M Bounty for Russian Hackers in Messaging App Cyberattacks
US government agencies have announced a reward of up to $10 million for information leading to the identification of individuals linked to two cyber threat groups tied to Russian intelligence. These groups, designated as UNC5792 and UNC4221 in public records, have been targeting current and former US government officials, military personnel, allied entities, journalists, political figures, and Ukrainian officials.
Threat Groups and Cyber Tactics
Recent alerts from the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FISA) reveal that the actors are conducting phishing campaigns focused on commercial messaging applications (CMAs). By impersonating automated support accounts within platforms like Signal, the attackers trick victims into clicking malicious links or sharing verification codes to gain unauthorized access to their accounts.
Backup Recovery Key Exploitation
A revised advisory from CISA and the FBI highlights that the threat actors have expanded their tactics to request Backup Recovery Keys, which grant access to historical conversations, including private and group messages. If a victim inadvertently shares this key, it remains valid even after they create a new account using the same phone number, allowing the attackers to potentially compromise the new account later. To mitigate this, users must generate a new Backup Recovery Key to invalidate the old one. However, this action does not remove existing access to the compromised account.
Link to Russian Intelligence Services
UNC5792 and UNC4221 are associated with Russian intelligence services (RIS), according to the Rewards for Justice portal. UNC5792 is linked to the Russian Federal Security Service (FSB) Border Guards, while UNC4221 is connected to the Russian military. The US government emphasizes that these actors employ social engineering to exploit legitimate device-linking features in secure messaging apps, enabling unauthorized access to sensitive communications, contact lists, and group discussions.
UNC5792 and UNC4221 are associated with Russian intelligence services (RIS), according to the Rewards for Justice portal.
Reward Program Details
The reward program seeks details on the identities, locations, and biographies of UNC5792 actors, as well as their ties to RIS, supporting entities, infrastructure, tools, funding sources, and financial networks, including banking accounts, cryptocurrency wallets, and transaction records. Compromised accounts have been used to launch further phishing attacks against other high-value targets, with instances of attackers modifying group invite pages to link malicious devices to victims’ Signal accounts.
User Security Advisory
The advisory also underscores the evolving nature of these attacks, which leverage trusted features of messaging platforms to bypass security measures and exfiltrate critical data. Users are advised to remain vigilant against unsolicited requests for sensitive information and to regularly update security settings on their communication tools.
About Author
English