Russian Intelligence Services Targeting Commercial Messaging Applications Campaign

Russian IntelligenceSignal PhishingDevice Linking AbuseCyber EspionageCredential Theft

Russian Intelligence Services (RIS) are conducting an ongoing campaign that compromises Signal, WhatsApp, and Telegram accounts belonging to government officials, military personnel, journalists, and activists across Ukraine, Europe, and the United States by impersonating messaging-platform support and abusing the legitimate device-linking feature.

Indicators of Compromise

Domains (23)

groups-signal.sitegroup-teneta.onlineteneta.add-group.sitesignalgroup.sitehelperanalytics.rusignal-groups-add.comsignal-device-off.onlinesignal-group-add.comconfirm-signal.siteadd-signal-groups.comteneta.groupgroup-signal.comgroup.kropyva.sitesignal-group.techteneta.join-group.onlinesignal-protect.hostsignal-groups.sitesignal-groups.techsignals-group.comsignal-security.site+3 more

Hashes (4)

e078778b62796bab2d7ab2b04d6b01bfb379d8f583112cad3cf60f95ab3a67fda97a28276e4f88134561d938f60db495b27ff24870d93d651ee1d8e06276fa98

APT Groups

Turla Group

Russian Federation

ELECTRUM

Ghostwriter

UAC-0185

Notes

NOTES/CONCLUSIONThis campaign is notable because it requires no exploitation of Signal, WhatsApp, or Telegram themselves — the cryptography remains intact. RIS operators succeed entirely through social engineering: impersonating automated support, manufacturing urgency around fake "mandatory two-factor" or "sync error" notices, and abusing the legitimate linked-devices feature so that a victim's messages silently mirror to an attacker-controlled instance. The June 2026 evolution toward eliciting Signal Backup Recovery Keys is significant: a stolen key grants access to historical messages and remains valid even after the victim re-registers the same phone number, so remediation requires generating a new Backup Recovery Key, not merely re-installing the app.Recommended SOCRadar modules for tracking and exposure reduction: <a href="https://socradar.io/free-tools/ioc-radar">IOC Radar</a>, <a href="https://socradar.io/products/cyber-threat-intelligence/">Cyber Threat Intelligence</a>, <a href="https://socradar.io/products/attack-surface-management/">Attack Surface Management</a>, and <a href="https://socradar.io/products/dark-web-monitoring/">Dark Web Monitoring.</a><div> </div>

Mitigation

MITIGATION <div style="margin-left:0pt;" align="left"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col></colgroup><thead><tr style="height:0pt;"><th style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#0b2545;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Technique</th><th style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#0b2545;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Tactic</th><th style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#0b2545;padding:4pt 6pt 4pt 6pt;overflow:hidden;overflow-wrap:break-word;">Mitigations (M-Codes)</th></tr></thead><tbody><tr style="height:0pt;"><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1566/002/">T1566.002</a>Spearphishing Link</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0001/">TA0001</a> Initial Access</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1054/">M1054</a> Software Configuration;  <a href="https://attack.mitre.org/mitigations/M1021/">M1021</a> Restrict Web-Based Content;  <a href="https://attack.mitre.org/mitigations/M1047/">M1047</a> Audit;  <a href="https://attack.mitre.org/mitigations/M1018/">M1018</a> User Account Management;  <a href="https://attack.mitre.org/mitigations/M1017/">M1017</a> User Training</td></tr><tr style="height:0pt;"><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1566/003/">T1566.003</a>Spearphishing via Service</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0001/">TA0001</a> Initial Access</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017/">M1017</a> User Training;  <a href="https://attack.mitre.org/mitigations/M1018/">M1018</a> User Account Management;  <a href="https://attack.mitre.org/mitigations/M1049/">M1049</a> Antivirus/Antimalware;  <a href="https://attack.mitre.org/mitigations/M1021/">M1021</a> Restrict Web-Based Content;  <a href="https://attack.mitre.org/mitigations/M1047/">M1047</a> Audit</td></tr><tr style="height:0pt;"><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1598/003/">T1598.003</a>Spearphishing Link</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0043/">TA0043</a> Reconnaissance</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017/">M1017</a> User Training;  <a href="https://attack.mitre.org/mitigations/M1054/">M1054</a> Software Configuration</td></tr><tr style="height:0pt;"><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1684/001/">T1684.001</a>Impersonation</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0005/">TA0005</a> Stealth</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017/">M1017</a> User Training;  <a href="https://attack.mitre.org/mitigations/M1019/">M1019</a> Threat Intelligence Program</td></tr><tr style="height:0pt;"><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1204/001/">T1204.001</a>Malicious Link</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0002/">TA0002</a> Execution</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1031/">M1031</a> Network Intrusion Prevention;  <a href="https://attack.mitre.org/mitigations/M1017/">M1017</a> User Training;  <a href="https://attack.mitre.org/mitigations/M1021/">M1021</a> Restrict Web-Based Content</td></tr><tr style="height:0pt;"><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1111/">T1111</a>Multi-Factor Authentication Interception</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0006/">TA0006</a> Credential Access</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1017/">M1017</a> User Training</td></tr><tr style="height:0pt;"><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1098/005/">T1098.005</a>Device Registration</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0003/">TA0003</a> Persistence</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1032/">M1032</a> Multi-factor Authentication</td></tr><tr style="height:0pt;"><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1005/">T1005</a>Data from Local System</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0009/">TA0009</a> Collection</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1057/">M1057</a> Data Loss Prevention</td></tr><tr style="height:0pt;"><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/001/">T1059.001</a>PowerShell</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0002/">TA0002</a> Execution</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1042/">M1042</a> Disable or Remove Feature or Program;  <a href="https://attack.mitre.org/mitigations/M1049/">M1049</a> Antivirus/Antimalware;  <a href="https://attack.mitre.org/mitigations/M1045/">M1045</a> Code Signing;  <a href="https://attack.mitre.org/mitigations/M1026/">M1026</a> Privileged Account Management;  <a href="https://attack.mitre.org/mitigations/M1038/">M1038</a> Execution Prevention</td></tr><tr style="height:0pt;"><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/003/">T1059.003</a>Windows Command Shell</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0002/">TA0002</a> Execution</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1038/">M1038</a> Execution Prevention</td></tr><tr style="height:0pt;"><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1567/002/">T1567.002</a>Exfiltration to Cloud Storage</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0010/">TA0010</a> Exfiltration</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1021/">M1021</a> Restrict Web-Based Content</td></tr><tr style="height:0pt;"><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1119/">T1119</a>Automated Collection</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0009/">TA0009</a> Collection</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;background-color:#f2f6fa;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/mitigations/M1029/">M1029</a> Remote Data Storage;  <a href="https://attack.mitre.org/mitigations/M1041/">M1041</a> Encrypt Sensitive Information</td></tr><tr style="height:0pt;"><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1074/001/">T1074.001</a>Local Data Staging</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/tactics/TA0009/">TA0009</a> Collection</td><td style="border-left:solid #bbbbbb 0.5pt;border-right:solid #bbbbbb 0.5pt;border-bottom:solid #bbbbbb 0.5pt;border-top:solid #bbbbbb 0.5pt;vertical-align:middle;padding:3.5pt 6pt 3.5pt 6pt;overflow:hidden;overflow-wrap:break-word;">No mitigation available — detection only</td></tr></tbody></table></div>