End-to-end encryption was never the vulnerability. It rarely is. The weakest link, as experienced security professionals have long understood, is the human being holding the device — and Russian intelligence operatives have once again demonstrated a sophisticated understanding of that reality.
Federal authorities have issued an updated warning revealing that a long-running phishing campaign attributed to Russian Intelligence Services (RIS) has materially evolved. What began as an effort to hijack Signal accounts through verification code theft and unauthorized device linking has now pivoted to a more insidious objective: stealing Signal Backup Recovery Keys. The implications are significant — and the targeting list reads like a geopolitical who's who.
From Account Hijacking to Message Archive Theft
The original campaign, flagged in an advisory earlier this year, involved threat actors impersonating Signal's automated support infrastructure to phish for account PINs or trick users into linking attacker-controlled devices. That approach, while effective, carried inherent limitations — it required ongoing access to a victim's active account.
The updated tactic is considerably more dangerous. By targeting Backup Recovery Keys, attackers can restore a victim's entire encrypted message archive to any device they control — completely offline, with no continued need to maintain presence in the victim's account. It is a surgical extraction of historical intelligence, packaged neatly by the victim themselves.
Signal's Secure Backup feature encrypts conversation archives using a recovery key that only the account holder should ever possess. Anyone holding that key can restore the full backup — messages, media, and all — to a device of their choosing.
The campaign is publicly tracked under the designations UNC5792 and UNC4221, and is linked to officers embedded within Russia's Federal Security Service (FSB) Border Guards as well as operatives acting on behalf of Russian military interests.
Anatomy of the Attack: A Two-Stage Social Engineering Play
The mechanics of this updated campaign reflect a refined understanding of how users interact with messaging platform notifications. Attackers impersonate Signal's support team, initiating contact with a message that exploits geopolitical anxiety — warning that accounts are under threat from hackers originating in Iran and post-Soviet states, and that Signal is now enforcing mandatory two-factor verification in response.
The message walks victims through a precise series of steps: navigate to Settings, enable backups, view the recovery key, copy it to the clipboard. The instructions are technically accurate — they mirror Signal's own interface — which lends the message an air of legitimacy that generic phishing rarely achieves.
A second message follows, this time invoking urgency around a fabricated synchronization error threatening permanent data loss. Victims are instructed to paste their recovery key directly into the conversation to "resolve" the issue.
Once that key is surrendered, the attacker can recover the full message archive at leisure, with no further interaction required from the victim.
A Critical Detail Many Will Miss
Buried in the advisory is a technical nuance that carries serious remediation consequences. Many victims, upon discovering their account has been compromised, instinctively create a new Signal account tied to the same phone number — assuming this invalidates any previously stolen credentials.
It does not.
A stolen Backup Recovery Key remains valid until the account holder manually generates a new one through Signal's backup settings. Only then is the previous key invalidated for future backup downloads. However — and this is the part that stings — any backup already downloaded using the compromised key remains accessible to the attacker permanently. Rotating the key closes the door going forward, but cannot retrieve what has already been taken.
Who Is Being Targeted?
The targeting profile confirmed by federal authorities should be a wake-up call for anyone operating in high-stakes communications environments. Current and former government officials, active military personnel, elected and appointed political figures, journalists covering sensitive geopolitical topics, and officials based in Ukraine are all explicitly named as priority targets.
This is not a campaign built for financial gain or opportunistic crime. It is an intelligence collection operation, and Signal's trusted reputation as a secure communications platform makes it an especially attractive attack surface — not for its cryptographic weaknesses, but for the false sense of security it may inspire in high-value targets.
What You Should Do
The Broader Lesson
This campaign illustrates a principle that should anchor every organizational security awareness program: encryption protects data in transit and at rest, but it cannot protect users from voluntarily handing over the keys. Russian intelligence operators clearly understand this, and they are investing in increasingly sophisticated social engineering to exploit it.
For security leaders, the takeaway extends beyond Signal. Any platform offering backup or recovery mechanisms — particularly those tied to cloud storage — represents a potential attack surface if users can be manipulated into disclosing recovery credentials. Training programs, communication policies, and incident response playbooks all need to account for this evolving threat vector.
The encryption held. The social engineering didn't have to break it.
