Google Warns of Russian Cyber Attacks on Signal Messenger

Google’s Threat Intelligence Group (GTIG) has identified efforts by Russian state-affiliated threat actors to infiltrate Signal Messenger accounts belonging to individuals of interest to Russian intelligence services.

This escalation is believed to be driven by wartime imperatives to access sensitive governmental and military communications amid Russia’s renewed offensive in Ukraine.

Signal’s widespread adoption among military personnel, politicians, journalists, activists, and other vulnerable groups has rendered it a prime target for adversaries aiming to intercept confidential information. This threat is not confined to Signal; other messaging platforms like WhatsApp and Telegram are also being actively targeted.

In response, GTIG has issued a public advisory detailing the observed tactics to enhance awareness and help users protect themselves from such threats.

Collaborating closely with Signal, GTIG has facilitated the implementation of enhanced security features in the latest Android and iOS versions of the app. These updates aim to fortify defenses against phishing attacks, particularly those exploiting the device-linking feature.

One prevalent attack vector involves sophisticated remote phishing schemes where malicious QR codes are embedded in counterfeit applications masquerading as tools used by the Ukrainian military. Scanning these QR codes can inadvertently link a victim’s device to an attacker-controlled system.

This device-linking strategy poses a significant challenge due to the absence of centralized detection mechanisms capable of monitoring account compromises via newly linked devices.

To mitigate the risk of such intrusions, individuals who may be targeted by state-sponsored actors are advised to:

• Enable screen locks
• Keep software updated
• Activate Google Play Protect on Android devices
• Regularly review linked devices
• Exercise caution with QR codes
• Utilize two-factor authentication (2FA)
• Consider enabling Lockdown Mode on iPhones

By implementing these measures, users can enhance the security of their communications and reduce the likelihood of unauthorized access to their messaging accounts.