Signal again: Ukrainian military suffers new cyberattacks in messenger
19 March 09:42
The government’s Computer Emergency Response Team (CERT-UA) has recorded multiple cases of cyberattacks against employees of Ukraine’s defense industry and the military. This was reported by CERT-UA, according to
It is noted that during March 2025, the Signal messenger revealed the facts of the distribution of messages with archives, which allegedly contain a report on the results of the meeting. At the same time, in some cases, to increase confidence, messages could be sent from people from the list of existing contacts whose accounts had been compromised in advance.
CERT-UA reminded that such activity has been tracked using the UAC-0200 identifier since at least the summer of 2024. At the same time, since February 2025, the content of decoy messages has been related to UAVs, electronic warfare, etc.
The use of popular messengers, both on mobile devices and computers, significantly expands the space for attacks, in particular by creating uncontrolled (in the context of security) channels for information exchange.
Messenger avoided cooperation with law enforcement
The National Security and Defense Council of Ukraine has previously accused Signal messenger of refusing to cooperate with law enforcement agencies, which makes it difficult to fight enemy cyberattacks. Deputy Secretary of the National Security and Defense Council Serhiy Demediuk made the statement during an international cybersecurity forum.
As the NSDC explained at the time, after the arrest of Pavel Durov in Paris, Telegram began to cooperate with government and law enforcement agencies, which forced Russian cybercriminals to switch to Signal. The lack of interaction between the messenger and law enforcement makes it difficult to detect and neutralize attacks.
Google representatives reported cyberattacks via the messenger
Google’s Threat Intelligence Group has released a study that draws attention to the fact that the APT44 hacker group (also known as Sandworm) and other hackers with ties to Russia have invented new ways to spy on Signal accounts used by the Ukrainian military and government officials.
As noted in a study by the Google Threat Intelligence Group, this is often done through malicious QR codes, as well as through devices captured on the battlefield.
Google recommended that all Signal users update the app to the latest version.
