The U.S. government has publicly linked two hacker groups, UNC5792 and UNC4221, to Russia's intelligence and military services. These groups conduct phishing campaigns targeting Signal and WhatsApp users, particularly U.S. government and allied personnel. The primary attack vector involves social engineering to steal Signal Backup Recovery Keys by impersonating support agents and requesting verification codes or recovery keys. While the encryption of the messaging platforms remains intact, the attackers gain access to private communications by exploiting user trust. The U.S. Department of State's Rewards for Justice program offers up to $10 million for information leading to the identification or location of these threat actors. FBI and CISA advisories provide updated tactics and emphasize the importance of recognizing fraudulent support communications.

The impact involves unauthorized access to private communications on Signal and WhatsApp through social engineering attacks that steal backup recovery keys. This compromises the confidentiality of targeted individuals' past messages and data stored in backups. The threat primarily affects high-value targets such as government officials, military leadership, journalists, and researchers. The encryption protocols of the messaging platforms themselves are not compromised, but the attacker’s success in tricking users leads to significant privacy breaches.

No official patch or fix is applicable as the threat exploits social engineering rather than a software vulnerability. Users of Signal and WhatsApp should be aware that legitimate support teams communicate only via official company email addresses and never request verification codes or recovery keys through in-app messages or links. Users must refuse to provide such sensitive information in response to unsolicited messages. Organizations should educate their personnel about these phishing tactics and verify any support communications through official channels. The U.S. government and security agencies have issued advisories with detailed guidance on recognizing and avoiding these attacks.