IC Technology & Cyber — 2026-07-03

FBI Warns Russian Hackers Targeting Individuals of High Intelligence Value Through Signal Phishing as House Cyber Chairman Reveals Compromise

BLUFRussia's proven ability to compromise a congressional cyber chairman through basic social engineering means additional NATO-country officials will likely be identified as victims within 90 days.

Rep. Don Bacon (R-NE), chairman of the House Armed Services Cyber subcommittee, said Wednesday that Russian government-linked operatives had compromised his Signal account months earlier by posing as a close acquaintance, Straight Arrow News reported . The FBI issued an alert days earlier warning that Russian hackers have targeted "individuals of high intelligence value" by posing as Signal customer support employees to trick targets into surrendering backup recovery keys, enabling attackers to load a copy of a user's messages onto a new device . Der Spiegel reported in April that the same tactic compromised more than 300 accounts in Germany, including those of high-profile politicians . The attacks exploit social engineering rather than any vulnerability in Signal's end-to-end encryption; Signal responded in March by introducing notifications warning users it will never request a registration code, PIN, or recovery key .

Analysis
Russian intelligence services are running the same Signal social-engineering playbook, tricking targets into surrendering backup recovery keys rather than exploiting any cryptographic flaw, against officials across multiple NATO states, with Bacon's disclosure extending the documented scope from Germany's 300-plus compromised accounts to a confirmed US congressional target. The months-long gap between compromise and disclosure gave attackers sustained access to sensitive communications before notification, and additional intelligence-community or government officials beyond Germany will likely be identified as victims within 90 days given the FBI's "individuals of high intelligence value" framing. Bacon's characterization of Signal itself as insecure conflates the attack vector with the app's encryption architecture, likely reflecting his broader opposition to administration use of encrypted messaging. Sourcing rests on a single outlet synthesizing Bacon's statements, the FBI alert, and prior German reporting without independent confirmation of current campaign scope. Further identifications would confirm active cross-country expansion requiring coordinated counterintelligence guidance for government Signal users, while silence would suggest containment to the populations already named.

1 sources

Congressman says hack of his Signal account proves app is unsecure. Is it true? - Straight Arrow News