FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys

Russian intelligence-linked threat actors (UNC5792 and UNC4221) are exploiting Signal's backup recovery key feature through social engineering to gain persistent access to victims' encrypted message histories. The root cause is a combination of insufficient user awareness about the sensitivity of backup recovery keys and a lack of procedural controls around how these credentials are shared or stored. Because Signal is widely trusted for secure communications, high-value targets—journalists, officials, activists—may be less guarded when interacting with what appears to be a legitimate Signal prompt or support request. Thousands of accounts have already been compromised globally, demonstrating that even end-to-end encrypted platforms are vulnerable when human factors are exploited. This attack highlights that cryptographic security is meaningless if the recovery credentials themselves can be socially engineered out of users.