A quiet but consequential update to a federal cybersecurity advisory has exposed a significant tactical evolution in Russian intelligence operations targeting encrypted communications. The FBI and CISA have revised their earlier guidance to reveal that FSB-linked threat actors are no longer primarily chasing one-time verification codes — they're after something far more durable: Signal Backup Recovery Keys.
A Smarter, More Persistent Attack
The original advisory, issued in March 2026, outlined a broad campaign by Russian intelligence service (RIS) cyber operators targeting government officials, military personnel, journalists, and Ukrainian contacts through impersonated Signal support messages. The June revision sharpens that picture considerably, assigning public tracking designations — UNC5792 and UNC4221 — to the actors involved, both linked to FSB officers including personnel embedded with FSB Border Guards and those operating on behalf of Russian military services.
What changed operationally is the prize these groups are now chasing. Earlier iterations of the campaign relied on tricks most security-aware users have at least heard of: phishing for SMS verification codes, harvesting account PINs, or exploiting doctored group invite links to silently tether an attacker's device to a victim's account. Effective, but limited. A stolen code expires. A linked device can be spotted and removed.
A Backup Recovery Key is different. It doesn't expire. It doesn't disappear if the user changes their phone number. And critically, according to the updated advisory, it remains valid even if the victim creates an entirely new Signal account using that same phone number after discovering the compromise.
"If a victim inadvertently shares their Backup Recovery Key, that same key remains valid even if they create a new account following the compromise using the same phone number. Consequently, the actor could potentially use the compromised key to take over the new account in the future as well." — FBI/CISA Joint Advisory
That single detail transforms what might otherwise look like a routine phishing play into a mechanism for long-term, persistent access — precisely the kind of foothold a state intelligence service values most.
How the Phishing Messages Work
The tradecraft is deliberately unglamorous. Targets receive in-app messages dressed to look like automated Signal system notifications. Two variants are documented in the advisory: one framed as a mandatory two-factor security rollout requiring immediate action, the other as an urgent warning that the user's message history is at risk of permanent deletion unless they act now.
Both follow the same operational logic. The message walks the victim through a step-by-step process — enabling Signal's backup feature, navigating into settings to locate the Recovery Key, and pasting it directly into the chat window. There is no malware involved. No zero-day exploit. The attacker is simply guiding the target through a legitimate application feature and collecting the output.
Once obtained, that key unlocks the account's entire backed-up message archive: private conversations, group messages, and the ability to assume control of the account itself. The attacker doesn't need to intercept a single encrypted packet. The user does the work for them.
What This Attack Is Not
Federal agencies are unusually direct on a point that often gets muddied in public reporting: this campaign does not represent a cryptographic break in Signal, nor any flaw in the application's architecture. Signal's encryption remains intact. The platform itself has not been compromised.
What has been compromised, repeatedly, is the human operating the account. This is a social engineering operation dressed in the language of technical urgency, and its effectiveness depends entirely on the target believing that a legitimate system notification would ever ask them to share a security credential through the same channel it purports to protect.
The same fundamental tradecraft has been observed migrating to WhatsApp and Telegram, suggesting these operators are systematically probing for the same vulnerability across every major encrypted messaging platform: users who haven't been told what legitimate support looks like.
Wider Intelligence Context
This campaign does not exist in isolation. Parallel warnings have been issued by Dutch intelligence services, Germany's BfV and BSI, and France's ANSSI, reflecting a coordinated European awareness of the same threat actor infrastructure. Google's Threat Intelligence Group documented UNC5792 abusing Signal's linked-device feature as early as 2025. The June advisory represents the most operationally specific public disclosure to date.
The State Department's Rewards for Justice program has announced a reward of up to $10 million for actionable information on UNC5792, a signal of how seriously the U.S. government is treating the sustained nature of this activity.
What You Should Do
If you work in government, national security, journalism, policy, or any field that places you in proximity to sensitive information, treat the following guidance as non-negotiable:
The Bottom Line
The encryption holds. The application holds. What is failing is the layer between the software and the person using it — and that is exactly where sustained, state-level intelligence operations are designed to apply pressure. The campaign documented here is deliberate, well-resourced, and still active. Understanding the mechanism is the first step toward not becoming part of the dataset it continues to build.
