Google warns: Russian hackers attack Signal messenger
21 February 14:07
Google’s Threat Intelligence Group reports that the APT44 hacker group (also known as Sandworm) and other hackers with ties to Russia have invented new ways to spy on Signal accounts used by the Ukrainian military and government. This is reported by DEV.ua, Komersant ukrainskyi informs.
As noted in a new study by the Google Threat Intelligence Group, this is often done through malicious QR codes, as well as through devices captured on the battlefield.
The research describes several tactics, including a new method that exploits Signal’s “Connected Devices” feature. A successful attack gives attackers access to real-time messages. It is difficult to detect, which allows for long-term surveillance.
Such attacks are often disguised as group invitations or security alerts, some even imitating military applications. When a victim scans a malicious QR code, their Signal account is invisibly linked to a device controlled by an attacker. This makes it possible to intercept secure conversations in real time, even without gaining full access to the victim’s device.
“Russian intelligence services are stepping up their attempts to hack secure messengers, including Signal, recognizing their critical role in the confidential communications of Western military, politicians and other high-risk individuals. The diverse tactics used by Russia to target Signal, from remote phishing attacks to the exploitation of physically seized devices, are a serious warning of the growing threat to the tools that society increasingly relies on for secure and private communication. We believe that these tactics are likely to spread beyond Ukraine and become more globally used in the near future,” said Dan Black, principal analyst at Google Threat Intelligence Group.
It is worth noting that after the discovery of this threat, the Signal team worked closely with GTIG to investigate these incidents. Subsequently, updates for Android and iOS were released to protect users from similar phishing attacks in the future.
Google recommends that all Signal users update the app to the latest version.
