Russian Intelligence Services Espionage Campaign Targeting Signal Accounts and Encrypted Messaging Applications

Technical and Strategic AnalysisFBI/CISA PSA I-032026-PSA — March 20, 2026 | TLP:CLEAR

1. Executive Summary — Board Level / Strategic View

On March 20, 2026, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) jointly published a public service announcement (PSA I-032026-PSA) alerting the public to an active campaign by cyber actors associated with the Russian Intelligence Services (RIS) targeting Commercial Messaging Application (CMA) accounts. The primary application targeted is Signal, though the campaign is documented as applicable to other CMAs. This advisory follows a similar warning issued in early March 2026 by Dutch intelligence agencies MIVD and AIVD, and research published in February 2025 by Google Threat Intelligence Group.

The campaign does not rely on any cryptographic compromise or technical vulnerability in the applications themselves. RIS actors exploit social engineering and phishing techniques to obtain unauthorized access to individual accounts, entirely bypassing end-to-end encryption. The PSA explicitly states that CMA encryption has not been compromised.

The targeted profiles correspond to high-intelligence-value individuals: current and former U.S. government officials, military personnel, political figures, and journalists. The campaign is global in scope and has resulted in the unauthorized compromise of several thousand individual accounts.

Once an account is compromised, actors can read past and future messages, access contact lists, send messages on behalf of the victim, and conduct secondary phishing campaigns from a trusted identity. The impact on communications confidentiality is direct and immediate, regardless of the robustness of the underlying cryptographic protocol.

From a regulatory standpoint, organizations subject to the NIS2 Directive, DORA Regulation, or GDPR are exposed to risks of personal data and communications breaches if their personnel use CMAs for professional purposes on unmanaged devices. A compromise of a CMA account containing third-party personal data may constitute a data breach within the meaning of Article 33 GDPR, triggering a notification obligation to the competent supervisory authority within 72 hours.

Priority strategic decisions concern: the inventory and audit of devices linked to Signal accounts of sensitive-profile personnel, the definition or update of a formal CMA usage policy, the strengthening of authentication procedures on these applications, and the immediate dissemination of a targeted awareness communication.

2. Threat Landscape Positioning

2.1 Global Context

Russian intelligence services have historically targeted the communication infrastructures of adversarial governments, non-governmental organizations, media outlets, and military personnel. The widespread adoption of end-to-end encryption in consumer CMAs has led these actors to reorient their TTPs toward exploiting the human layer rather than the cryptographic layer. The targeting of CMAs is part of a documented operational adaptation spanning several years.

2.2 Historical Background

The first documented public evidence of abuse of Signal’s linked devices feature by Russia-aligned actors dates to 2024. In February 2025, Google Threat Intelligence Group published an analysis documenting multiple Russian activity clusters targeting Signal: UNC5792 and UNC4221, assessed as acting in support of Russian intelligence objectives. APT44 (Sandworm / Seashell Blizzard, attributed to GTsST/GRU) was documented using malicious QR codes in close-access operations on devices captured in the field in Ukraine, enabling the association of Signal accounts with actor-controlled infrastructure.

In December 2025, Amazon documented a long-running operation attributed to Russian military intelligence targeting Western critical infrastructure between 2021 and 2025, attributed to the Sandworm hacking group. In March 2026, the Dutch MIVD and AIVD agencies published a warning about a large-scale global campaign targeting Signal and WhatsApp, before the FBI and CISA published their joint advisory on March 20, 2026.

2.3 Threat Actors Involved

Actor	Attribution	Documented TTP
APT44 / Sandworm / Seashell Blizzard	GRU / GTsST	Malicious QR codes, close-access operations
COLDRIVER / UNC4057 / Star Blizzard	FSB	WhatsApp linked device abuse
Turla	FSB Center 16	PowerShell script, Signal Desktop DB staging
UNC5792, UNC4221	RIS (Google TIG)	Remote phishing, impersonation
UNC1151	Belarus-linked	Robocopy, Signal Desktop staging

2.4 Operational Model

This campaign does not have a financial objective. It is part of a strategic intelligence collection framework combining SIGINT and digital HUMINT approaches, aimed at obtaining real-time access to the encrypted communications of high-value targets. The model relies on exploiting the human factor rather than technical vulnerabilities, which makes it particularly resistant to purely technological countermeasures.

2.5 MITRE ATT&CK Mapping

Technique ID	Name	Documented Usage
T1566	Phishing	Primary Initial Access vector
T1566.004	Spearphishing via Service	Direct messages impersonating Signal support
T1078	Valid Accounts	Account takeover via phished credentials
T1098	Account Manipulation	Linked device abuse
T1539	Steal Web Session Cookie	Functional analogy: theft of authenticated access
T1119	Automated Collection	Signal Desktop DB staging
T1041	Exfiltration Over C2 Channel	Malware variants Turla / UNC1151

2.6 Trends (12–24 Months)

The progression observed over the 2024–2026 period shows increasing industrialization of phishing targeting CMAs, with dedicated phishing kits mimicking Signal authentication and support interfaces. The documented extension to WhatsApp and Telegram confirms a platform-agnostic strategy. The involvement of multiple Russian actor clusters (GRU, FSB, Belarusian allies) indicates institutional prioritization of this attack vector.

3. Technical Deep Dive

3.1 Initial Access Vectors

Vector 1 — Linked Device Feature Abuse

The Signal Linked Devices feature allows a Signal account to be associated with multiple devices by scanning a QR code. A QR code encodes a linking URI that, when scanned by the victim’s Signal application, authorizes the association of a new device with the account.

The actor constructs a malicious QR code encoding a linking URI pointing to an actor-controlled device. This QR code is delivered to the victim via a phishing message impersonating either a known contact or an official Signal support service (e.g., invitation to join a group, security alert).

If the victim scans the QR code or clicks the associated link, the actor’s device is linked to the victim’s Signal account. From that point, all future messages sent and received by the victim are delivered simultaneously to both the victim and the actor in real time. The victim retains access to their account, which delays detection. The linked device remains active until explicitly removed via Settings > Linked Devices. In the absence of regular audits, persistence can be indefinite.

In the case of WhatsApp, the abuse of the Linked Devices feature presents an additional characteristic: unlike Signal, linking a WhatsApp device can allow access to historical messages predating the compromise. Furthermore, the victim may not be immediately disconnected, further reducing the likelihood of spontaneous detection.

APT44 has also been documented using this technique in close-access operations: malicious QR codes applied to documents or physical interfaces in conflict zones (Ukraine) have been used to link devices captured in the field to actor-controlled infrastructure for subsequent exploitation.

Vector 2 — Full Account Takeover

The actor initiates a registration attempt for the victim’s phone number on a new Signal instance under their control. Signal generates and sends an OTP (One-Time Password) via SMS to the victim’s phone number. Simultaneously, the actor contacts the victim via a phishing message impersonating an official Signal security notification from support chatbot, suspicious activity alert, unauthorized login notification and creating a sense of urgency.

The phishing message requests that the victim transmit the verification code received via SMS (the OTP the actor triggered) along with the account registration lock PIN. If the victim provides these elements, the actor completes the registration, gains exclusive control of the account, and the victim is disconnected from their Signal instance.

3.2 Exploitation Chain

Linked Device Feature Abuse

Reconnaissance of target and identification of known contacts
Construction of a malicious QR code encoding a Signal linking URI pointing to an actor-controlled device
Delivery of the QR code via phishing message (impersonation of contact or support service)
Victim interaction with the QR code or link
Automatic association of the actor’s device with the victim’s Signal account
Passive real-time collection of all incoming and outgoing messages

Account Takeover

Initiation of a Signal registration on a new device using the target’s phone number
Signal generates and sends an OTP via SMS to the target’s number
Actor sends an urgent phishing message impersonating Signal support to the victim
Victim transmits the OTP and PIN to the actor via the phishing channel
Actor completes registration and gains exclusive control of the account
Victim is disconnected from their Signal instance

3.3 Payload Characteristics

In the baseline vector (linked device abuse and account takeover), no malware is required. The payload is purely functional: the linking of the actor’s device constitutes the persistent access and collection mechanism itself. The FBI/CISA PSA mentions that evolving variants may incorporate malware components for targets most resistant to social engineering.

Documented malware variants:

Turla (FSB): lightweight PowerShell script deployed in post-compromise contexts to stage and exfiltrate the Signal Desktop database
UNC1151 (Belarus-linked actor): use of the legitimate Robocopy utility to stage Signal Desktop directory contents

Signal Desktop storage paths:

Windows : %APPDATA%\Signal\
macOS   : ~/Library/Application Support/Signal/
Linux   : ~/.config/Signal/

The Signal Desktop message database is encrypted with a derived key stored locally, accessible without knowledge of user credentials on a compromised system.

3.4 Persistence Mechanisms

For Linked Device Abuse, persistence is inherent to Signal’s legitimate feature: the linked device remains active until explicitly removed via Settings > Linked Devices. No system artifacts are created on the victim’s device. Persistence can be indefinite in the absence of regular linked device audits.

For Account Takeover, persistence is total: the actor controls the account and can modify its security settings, including the registration lock PIN, preventing straightforward recovery.

3.5 Defense Evasion Techniques

Complete absence of malware in the baseline vector: no signature detectable by EDR or antivirus solutions
Exclusive exploitation of legitimate application features (linked devices, account registration)
Impersonation of known contacts or official services to increase credibility
Low network footprint: no C2 visible from the victim’s device in the linked device abuse case
Victim account access maintained (linked device abuse): no native disconnection alert
Preferential targeting of personal unmanaged devices, outside SOC/MDM surveillance perimeter

3.6 Lateral Movement

Post-compromise of a CMA account, actors have the following capabilities:

Access to the compromised account’s contact lists, enabling identification of new high-value target profiles
Ability to send messages from the victim’s identity (trusted identity phishing), significantly increasing the credibility of secondary phishing attempts
Access to group conversations, enabling identification of participants and retrieval of organizational and network information

Lateral movement is thus primarily achieved through propagation via the victim’s digital social network, exploiting established trust between contacts.

3.7 Command and Control Architecture

In the baseline vector, no traditional C2 architecture is required. The actor’s Signal instance (linked device) directly receives the victim’s messages via the legitimate Signal infrastructure. In variants including a malware component (Turla, UNC1151), a separate C2 infrastructure is used for Signal Desktop file exfiltration.

3.8 Data Exfiltration Patterns

Incoming and outgoing messages in real time (linked device abuse) or full content access after account takeover
Contact lists and conversation metadata (group participants, timestamps)
Files and attachments exchanged via the compromised account
Malware variants: complete content of the local Signal Desktop database, including message history

3.9 Documented Behavioral Indicators

The FBI/CISA PSA does not publish technical IoCs (hashes, domains, IP addresses). Documented indicators are behavioral. Phishing patterns identified in messages reproduced in the PSA:

Impersonation of a “Signal Security Support ChatBot” reporting a data leak or unauthorized access attempt
Request to transmit a verification code received via SMS
Request to transmit the Signal account PIN
Notification of an unrecognized connected device with an IP address and geographic location
Announcement of a mandatory terms-of-service update requiring a “two-step verification” process

4. Detection and Response Engineering

4.1 Preventive Detection

Regular audit of the linked devices list: Settings > Account > Linked Devices — remove any unrecognized device
Activation of Registration Lock (PIN): Settings > Account > Registration Lock
Keeping CMA applications updated: Signal has released iOS and Android updates hardening linked device mechanisms in response to documented campaigns
Activation of message expiration features for sensitive conversations

4.2 Behavioral Detection

Monitoring for unsolicited Signal OTP reception on sensitive personnel devices (indicator of an account takeover attempt in progress)
Detection of incoming messages from known contacts containing unusual requests: OTP code sharing, QR code scanning, account validation
On managed devices: monitoring of access to Signal Desktop directories by non-standard processes (PowerShell, cmd.exe, Robocopy)

4.3 SOC Use Cases

UC1 : Signal Phishing Detection Alert on reception of messages containing keywords associated with documented phishing patterns (Signal Security, verification code, chatbot support, data leak, suspicious activity) from unknown or unverified identities. Applicable only on managed devices with MAM/MDM solutions allowing notification inspection.

UC2 : Unsolicited OTP / Incoming Contact Correlation Correlation between reception of an unsolicited Signal OTP SMS not initiated by the user and reception of an incoming Signal message within the following minutes. This pattern corresponds precisely to the sequence of an account takeover in progress.

UC3 : Signal Desktop File Access On managed Windows systems: EDR/Sysmon detection of access to %APPDATA%\Signal\ by non-whitelisted processes. Correlation with Windows Event IDs: 4663 (object access), Sysmon Event ID 11 (FileCreate), Event ID 1 (process creation).

4.4 Threat Hunting

Identify personnel with unrecognized linked devices in Signal via awareness campaign and self-declarative audit procedure
On managed Windows endpoints: hunt for processes having accessed %APPDATA%\Signal\ in the past 90 days, excluding Signal.exe itself
Identify PowerShell scripts having accessed Signal Desktop data directories or having used file copy cmdlets (Copy-Item, Robocopy) on these paths
Analyze MDM logs for unusual messaging application installations or activations on corporate devices

4.5 Blind Spots

Linked device feature abuse generates no detectable event on SOC infrastructure if the victim device is a personal unmanaged device
No EDR or MDM solution natively monitors Signal linked device lists
Phishing messages transit within Signal, not visible to enterprise email filtering gateways or web proxies
The absence of malware in the baseline vector eliminates any antiviral signature detection possibility
The victim session remaining active (linked device abuse) means anomaly-based login detection systems are not triggered

5. Risk and Impact Analysis

5.1 Operational Impact

The compromise of CMA accounts of sensitive-profile personnel results in direct exfiltration of confidential communications. Access to contact lists and group conversations exposes the relational networks of targeted organizations. The ability to send messages from the victim’s identity enables disinformation or targeted manipulation operations. In the documented geopolitical context (Ukraine, military aid), the compromise of communications between government and military officials represents a first-order operational impact for adversaries.

5.2 Supply Chain Impact

Compromised accounts are exploited as phishing vectors toward the victims’ contacts, including subcontractors, partners, and suppliers. This trust-delegated propagation mechanism (trusted identity phishing) constitutes a transversal contamination risk beyond the initial targets.

5.3 Regulatory Impact

Framework	Risk
NIS2 (Article 21)	Non-compliance on IS risk management if CMA usage is ungoverned
GDPR (Articles 33–34)	Notification obligation to supervisory authority within 72h if personal data compromised
DORA (Article 6)	Unmanaged ICT risk for financial entities

5.4 Qualitative Risk Assessment

Criterion	Level
Likelihood — high-intelligence-value profiles	HIGH
Severity of impact for targeted profiles	HIGH
Overall risk — directly targeted profiles	CRITICAL
Risk — organizations outside direct target profiles	MODERATE
Detection maturity required	HIGH

6. Mitigation Strategy

6.1 Immediate Containment Actions

Immediately audit the linked devices list on all Signal accounts of sensitive-profile personnel: Settings > Account > Linked Devices : remove any unrecognized device
Enable Registration Lock (PIN) if not already done: Settings > Account > Registration Lock
Never share a Signal OTP code or PIN with anyone, regardless of the apparent legitimacy of the request to Signal support never requests this information via direct message
Immediately disseminate an internal awareness note reproducing the phishing patterns documented in the FBI/CISA PSA of March 20, 2026
Establish an out-of-band verification procedure for any unusual request received via CMA, even from a known contact (phone call, separate email)

6.2 Tactical Hardening Measures

Enable automatic message expiration for all conversations containing sensitive information
Immediately update Signal applications on all concerned devices: the latest iOS and Android versions incorporate hardened mechanisms against these phishing campaigns
For managed devices: deploy MDM/MAM rules governing the use of unapproved CMAs for professional communications
Periodically scan participants in sensitive group discussions to detect duplicates or unknown identities

6.3 Structural and Architectural Improvements

Define and formalize a CMA usage policy for the organization: authorized scope, admissible information types, authorized devices, verification procedures
Evaluate replacing consumer CMAs with managed secure messaging solutions (Wire for Business, self-hosted Mattermost, certified solutions) for sensitive professional communications
Integrate CMA risk into the organization’s threat model and periodic risk assessments

6.4 CERT/CSIRT Playbook Enhancements

Update incident response playbooks to incorporate a CMA account compromise scenario: indicators, verification procedure, containment steps, regulatory notification if applicable
Define behavioral compromise indicators: unsolicited Signal OTP receipt, unrecognized linked device, messages sent from victim account without user action
Feed threat sharing platforms (MISP, sectoral ISACs) with documented behavioral patterns and phishing messages

7. Strategic Outlook (6–12 Months)

7.1 Probable TTP Evolution

Probable evolutions over next 6 to12 months include the systematic integration of malware components for targets most resistant to pure phishing, the confirmed extension to WhatsApp, Telegram, and other CMAs, and the use of generative artificial intelligence to personalize phishing messages and increase their credibility (linguistic adaptation, pretext contextualization, enhanced impersonation).

7.2 Industrialization Trends

The campaign’s structure standardized phishing kits, adaptable message templates, multi-platform targeting indicates an advanced industrialization level. Predictable extension includes targeting of profiles beyond government officials and military: defense sector executives, foreign policy researchers, directors of humanitarian organizations involved in Ukraine aid, journalists covering conflicts. The reuse of compromised accounts as second-generation phishing vectors constitutes a documented amplification mechanism.

7.3 Geopolitical Implications

The campaign is directly embedded in the context of the Ukraine conflict and persistent tensions between Russia and Western nations. The simultaneous involvement of GRU (APT44), FSB (Turla, COLDRIVER), and Belarusian allies (UNC1151) suggests institutional coordination at the level of Russian intelligence services on this attack vector. An intensification during periods of heightened geopolitical tension or major diplomatic events is to be anticipated.

7.4 Future Attack Surface Impact

The growing adoption of CMAs in professional environments mechanically expands the attack surface exposed to this vector. Organizations that do not formally govern CMA usage and do not conduct regular linked device audits face increasing exposure that is structurally difficult to instrument with conventional detection tools.

8. References

MITRE ATT&CK — T1098: https://attack.mitre.org/techniques/T1098/
FBI / CISA: https://www.ic3.gov/PSA/2026/PSA260320
CISA: https://www.cisa.gov/resources-tools/resources/russian-intelligence-services-target-commercial-messaging-application-accounts
Google Threat Intelligence Group: https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger
TechCrunch — MIVD / AIVD: https://techcrunch.com/2026/03/09/russian-government-hackers-targeting-signal-and-whatsapp-users-dutch-spies-warn/
The Record — Recorded Future: https://therecord.media/russian-hackers-target-signal-whatsapp-warn-dutch-intelligence-agencies
CyberScoop: https://cyberscoop.com/fbi-cisa-issue-psa-on-russian-intelligence-campaign-to-target-messaging-apps/
CISA Phishing Guidance: https://www.cisa.gov/resources-tools/resources/phishing-guidance-stopping-attack-cycle-phase-one
CISA Mobile Communications Best Practice Guidance: https://www.cisa.gov/resources-tools/resources/mobile-communications-best-practice-guidance
MITRE ATT&CK — T1566: https://attack.mitre.org/techniques/T1566/