Adversary Intelligence — 2026-05-01

Russia Suspected of Signal Messaging Attack Targeting German Politicians

The German government suspects Russian intelligence services of conducting a phishing campaign targeting politicians through the Signal messaging application, according to Reuters citing government sources. German prosecutors opened an espionage investigation on April 24 after identifying more than 300 compromised accounts. The attack exploited Signal's device-linking feature, which allows users to connect additional devices to their account, to intercept messages rather than attempting to break the application's end-to-end encryption.

Analysis
Exploiting user behavior rather than attacking encryption, the campaign reflects a deliberate Russian intelligence adaptation that scales because political targets on Signal believe they are already protected. Per a single Reuters report citing German government sources, Berlin has opened a formal espionage investigation, but formal attribution to Russian state actors within 60 days is unlikely. No minister is on record committing to attribution, forensic work is incomplete, and Germany's default posture favors extended interagency review and hedged public language. The infrastructure may instead belong to a criminal or hacktivist actor whose tooling overlaps with known Russian programs, and Berlin's public suspicion of Moscow may reflect political incentive ahead of completed technical work.
1 sources
  1. German government suspects Russia of Signal attack targeting politicians - Reuters

View in full brief →

UNCLASSIFIED // OPEN SOURCE