CISA and FBI Issue 10 Million Dollar Bounty for Russian UNC5792 Group Targeting Signal Backup Keys

The State Department's Rewards for Justice program is offering up to $10 million for information identifying or locating members of UNC5792, a cyber group it links to the Russian Federal Security Service's Border Guards, and UNC4221, which it ties to Russian military intelligence 12. RFJ states the groups ran phishing campaigns against Signal and WhatsApp accounts belonging to US government officials, military leadership, NATO member-state officials, journalists covering Russia and Ukraine, and Ukraine-focused NGOs, exploiting the apps' device-linking features rather than encryption flaws 1. In a Friday advisory cited by The Record, the FBI said the campaign has evolved toward stealing backup recovery keys, which can remain valid even after a victim creates a new account with the same phone number 2. Both RFJ and The Record describe a tactic in which attackers altered legitimate Signal group-invite pages to redirect victims to malicious links that linked an attacker-controlled device to the account 12. The Record adds that the US warning follows a similar advisory last week from Ukraine's SBU, which said it worked with the FBI on a related campaign targeting officials in Ukraine, Europe, and the United States 2.