Adversary Intelligence — 2026-05-14

Russian Government Hackers Targeted Spyware Investigator in Signal Hijacking Campaign

BLUFConvergent Western attribution and ApocalypseZ's self-propagating contact-harvesting design indicate Moscow has industrialized Signal account takeovers into a scalable intelligence platform against those investigating Kremlin activity.

Donncha Ó Cearbhaill, head of Amnesty International's Security Lab, told TechCrunch he was one of more than 13,500 targets in a campaign that impersonated Signal support to trick users into submitting verification codes, linking their accounts to attacker-controlled devices. Ó Cearbhaill identified the automation tool as "ApocalypseZ" and found its codebase, interface, and victim chat translations all in Russian. CISA, the UK's NCSC, and Dutch intelligence have attributed the same impersonation technique to Russian government actors; Der Spiegel separately reported that the hackers compromised several individuals inside Germany, including high-profile politicians. Netzpolitik.org reported in January that dozens of investigative journalists, including from Die Zeit and Correctiv, along with lawyers and civil society members, were also targeted.

Analysis
The targeting pattern, covering spyware investigators, investigative journalists, lawyers, and civil society, marks this almost certainly as a Russian intelligence collection operation focused on those who expose Kremlin-linked actors, corroborated across CISA, the UK NCSC, and Dutch intelligence. ApocalypseZ's Russian-language architecture reflects deliberate investment in durable tradecraft: its "snowball" mechanism harvests each compromised account's contact lists to identify the next target tier without fresh operator input, building structural self-expansion into the campaign's design. The 13,500-target figure is a floor; campaign activity continued through May 14 and total exposure is materially larger. A criminal or hacktivist actor using Russian-language tooling for attribution confusion remains a competing read, though convergent government attribution substantially undercuts it.

2 sources

A spyware investigator exposed Russian government hackers trying to hijack Signal accounts - TechCrunch
Signal Plans New Security Measures After Russian Hackers Hijack Hundreds of Accounts - CySecurity News