TLDR Tech / InfoSec
New FBI Alert: Russian Intelligence Uses Signal Recovery Keys to Access Messages
A joint FBI and CISA update to their March advisory names UNC5792 and UNC4221 as FSB-linked operators who have shifted their phishing objective from expiring verification codes to Signal Backup Recovery Keys, posing as automated support to walk targets through enabling backups and pasting the key into chat. The distinction the advisory keeps emphasizing is that nothing here breaks Signal's encryption: the account is the weak point, and a harvested recovery key unlocks the full historical archive and survives account recreation under the same phone number, so it functions as durable access rather than a one-session compromise. The broader signal for defenders of high-risk populations is that end-to-end guarantees stop at the human who can be talked into exporting their own keys, a pattern now mirrored against WhatsApp and Telegram and serious enough that Rewards for Justice has attached a $10 million bounty to UNC5792.
Read the full story