[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxSWcMSMpAIRynx5aEBRnzXdfTtFyy7TiMeKxUnDYugk":3},{"article":4,"iocs":53,"watch_terms":62,"solutions":63,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"028c4e40-7873-4754-818f-b962ba8e68df","U.S. offers $10 million for hackers targeting WhatsApp, Signal users","u-s-offers-10-million-for-hackers-targeting-whatsapp-signal-users-6e3b2d","The U.S. Department of State is offering up to $10 million for information that helps identify or locate members of the UNC5792 and UNC4221 hacker groups, which are linked to Russia's intelligence and military services. [...]","The U.S. Department of State is offering a $10 million reward for information leading to the identification or location of members of Russian-linked hacker groups UNC5792 and UNC4221. These groups are accused of phishing campaigns targeting Signal and WhatsApp accounts of U.S. officials and allied personnel, including stealing Signal Backup Recovery Keys by impersonating support agents. The attacks aim to compromise private communications and data, with thousands of accounts already compromised.","US offers $10M for info on Russian hackers targeting Signal\u002FWhatsApp users.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fus-offers-10-million-for-hackers-targeting-whatsapp-signal-users\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F06\u002F29\u002FRFJ.jpg","2026-06-29T15:09:43+00:00","2026-06-29T16:00:04.934269+00:00",8,[17,20,22,25,27],{"name":18,"type":19},"UNC5792","threat_actor",{"name":21,"type":19},"UNC4221",{"name":23,"type":24},"Signal","vendor",{"name":26,"type":24},"WhatsApp",{"name":28,"type":29},"Signal Backup Recovery Keys","product","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58],{"type":55,"value":56,"context":57},"mitre_attack","T1566.002","Phishing campaigns targeting Signal and WhatsApp accounts",{"type":59,"value":60,"context":61},"malware","SprySOCKS","Mentioned in related articles as a tool used by hackers",[23,26,28],{"controls":64,"vendors":150},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":95,"name":96,"problem":97,"products":98},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"slug":124,"name":125,"problem":126,"products":127},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[128,136,143],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-sat","Huntress Managed Security Awareness Training","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fsecurity-awareness-training","Security awareness training and phishing simulation, managed for you.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":124,"product_name":140,"url":141,"description":142},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":144,"product_name":147,"url":148,"description":149},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[],{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":166},"russian-hackers-phish-signal-whatsapp-accounts-of-us-officials","Russian Hackers Phish Signal & WhatsApp Accounts of U.S. Officials","Russian-linked threat groups UNC5792 and UNC4221 conducted sophisticated phishing campaigns impersonating support agents to steal Signal Backup Recovery Keys and compromise the private communications of U.S. officials and allied personnel. The root cause is a combination of insufficient security awareness — users were deceived by convincing social engineering — and inadequate access controls around sensitive account recovery mechanisms. This matters because encrypted messaging apps like Signal are often trusted implicitly, making users less vigilant about phishing attempts targeting them. With thousands of accounts already compromised, the breach of these channels poses serious national security and operational security risks.",[156,157,158,159,160,161,162,163,164,165],"CIS Control 14 – Security Awareness and Skills Training","CIS Control 6 – Access Control Management","NIST SP 800-53 AT-2 (Literacy Training and Awareness)","NIST SP 800-53 AC-2 (Account Management)","NIST SP 800-53 IA-5 (Authenticator Management)","NIST SP 800-63B – Digital Identity Guidelines (Phishing-Resistant AAL3)","MITRE ATT&CK T1566 – Phishing","MITRE ATT&CK T1530 – Data from Cloud Storage","GDPR Article 32 – Security of Processing","ITIL 4 – Information Security Management Practice",{}]