Russian Hackers Target Signal Backup Keys via Social Engineering
Russian intelligence-linked threat actors (UNC5792 and UNC4221) are exploiting Signal's backup recovery key feature through social engineering to gain persistent access to victims' encrypted message histories. The root cause is a combination of insufficient user awareness about the sensitivity of backup recovery keys and a lack of procedural controls around how these credentials are shared or stored. Because Signal is widely trusted for secure communications, high-value targets—journalists, officials, activists—may be less guarded when interacting with what appears to be a legitimate Signal prompt or support request. Thousands of accounts have already been compromised globally, demonstrating that even end-to-end encrypted platforms are vulnerable when human factors are exploited. This attack highlights that cryptographic security is meaningless if the recovery credentials themselves can be socially engineered out of users.
Tactical Insight
Immediate actions
- Treat your Signal backup recovery key as a top-tier secret—never share it via any channel, including with apparent Signal support contacts.
- Audit and revoke any linked devices on your Signal account immediately if you suspect compromise via Settings > Linked Devices.
- Re-generate your Signal PIN and backup recovery key if there is any doubt about prior exposure.
Long-term improvements
- Deliver targeted security awareness training to high-value individuals (executives, officials, journalists) specifically covering messaging app credential risks.
- Establish organizational policies classifying messaging app recovery keys as sensitive credentials subject to the same controls as passwords or MFA seeds.
- Implement a 'verify before you trust' protocol requiring out-of-band confirmation before any credential-related action is taken in response to unsolicited requests.
Detection measures
- Monitor for unauthorized linked devices on corporate or sensitive Signal accounts as part of regular account hygiene reviews.
- Establish incident reporting channels so that social engineering attempts targeting secure messaging apps are logged and analyzed for patterns.
- Include phishing simulations that mimic messaging-app credential harvesting in ongoing security awareness programs.