[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1E8pYoUFn_ewGZ2GXps_um4jg6jpwaziXsETtodm9zo":3},{"article":4,"iocs":53,"watch_terms":64,"solutions":65,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"b225daf4-ca75-459e-af0d-dccf740e86e4","FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys","fbi-warns-russian-intelligence-hackers-target-signal-backup-recovery-keys-b65ad5","The FBI and CISA have updated their March warning about Russian intelligence phishing Signal accounts, and the operators have added a step: they now coax targets into handing over their Signal Backup Recovery Key. Hand it over once, and the attacker can restore the account's backup, read the private and group message history, and take over the account. Worse, the key keeps working.","The FBI and CISA have updated their warning about Russian intelligence actors targeting Signal accounts. The attackers now specifically target Signal Backup Recovery Keys through social engineering, allowing them to restore and access message history. This tactic, used by UNC5792 and UNC4221, targets high-value individuals and has already compromised thousands of accounts globally.","FBI warns Russian intelligence hackers are targeting Signal backup recovery keys.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Ffbi-warns-russian-intelligence-hackers.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhjt2-y25_EiB31BmVQQpt9ne8mH9iPOJpYJmItVSIKGexUBmKRwzNSvDYzbVyRm9xxR6H0rE880CTv3QTblUdJgkRh2EoXqYGJ9wwOq-cOktE6iIvI0fZdeuxf8gTmdEpStuzq5CywuWYEjb32JqfwIznRc6YtDK_V5dFH1bcx2EoqvQ1Koieo4g7QDKA\u002Fs1600\u002Fsignal-phishing.jpg","2026-06-26T19:38:29+00:00","2026-06-26T20:00:23.1277+00:00",9,[17,20,22,25,27,30],{"name":18,"type":19},"UNC5792","threat_actor",{"name":21,"type":19},"UNC4221",{"name":23,"type":24},"FBI","vendor",{"name":26,"type":24},"CISA",{"name":28,"type":29},"Signal","product",{"name":31,"type":29},"WhatsApp","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":32,"icon":34,"name":35,"slug":36},null,"Threat Intelligence","threat-intelligence",[38,43,48],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",[54,58,61],{"type":55,"value":56,"context":57},"mitre_attack","T1598.003","Phishing for information",{"type":55,"value":59,"context":60},"T1078.004","Cloud Accounts (via social engineering)",{"type":55,"value":62,"context":63},"T1539","Steal Application Data (via recovery key)",[23,26,28],{"controls":66,"vendors":145},[67,96,122],{"slug":68,"name":69,"problem":70,"products":71},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":97,"name":98,"problem":99,"products":100},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[101,106,114],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":102,"product_name":103,"url":104,"description":105},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":123,"name":124,"problem":125,"products":126},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[127,133,138],{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":128,"product_name":129,"url":131,"description":132},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":134,"product_name":135,"url":136,"description":137},"managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":139,"product_name":142,"url":143,"description":144},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":162},"russian-hackers-target-signal-backup-keys-via-social-engineering","Russian Hackers Target Signal Backup Keys via Social Engineering","Russian intelligence-linked threat actors (UNC5792 and UNC4221) are exploiting Signal's backup recovery key feature through social engineering to gain persistent access to victims' encrypted message histories. The root cause is a combination of insufficient user awareness about the sensitivity of backup recovery keys and a lack of procedural controls around how these credentials are shared or stored. Because Signal is widely trusted for secure communications, high-value targets—journalists, officials, activists—may be less guarded when interacting with what appears to be a legitimate Signal prompt or support request. Thousands of accounts have already been compromised globally, demonstrating that even end-to-end encrypted platforms are vulnerable when human factors are exploited. This attack highlights that cryptographic security is meaningless if the recovery credentials themselves can be socially engineered out of users.",[151,152,153,154,155,156,157,158,159,160,161],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 5 – Account Management","CIS Control 3 – Data Protection","NIST SP 800-63B – Digital Identity Guidelines (Authenticator Management)","NIST AC-2 – Account Management","NIST AT-2 – Literacy Training and Awareness","NIST IR-6 – Incident Reporting","NIST MP-4 – Media Storage (protecting backup credentials)","GDPR Article 32 – Security of Processing (protecting personal data via appropriate technical and organizational measures)","MITRE ATT&CK T1598 – Phishing for Information","MITRE ATT&CK T1530 – Data from Cloud Storage",{}]