The UNC5792 reward gives tipsters a chance to claim up to $10 million for information about a Russian-linked hacking group accused of targeting secure messaging accounts used by NATO officials, diplomats, and organizations supporting Ukraine.
US authorities say the group focused on taking over Signal and WhatsApp accounts through phishing and account-linking tricks, rather than breaking the apps’ encryption.
Hackers Targeted Messaging Accounts
UNC5792 allegedly used social engineering to convince victims to connect their messaging accounts to attacker-controlled devices.
Once the hackers gained access, they could read messages, view contacts, and use trusted accounts to approach new targets. That tactic made the campaign especially dangerous for officials and organizations involved in sensitive work connected to Ukraine.
US Officials Seek Information on the Group
The US State Department is offering the reward for details that could help identify or locate UNC5792 members.
Investigators want information about the group’s operators, infrastructure, domains, servers, cryptocurrency wallets, and financial activity. Those details could help authorities disrupt the operation and pursue criminal charges.
FBI Warns About Signal Recovery Keys
The FBI also warned that Russian-linked hackers are trying to steal Signal Backup Recovery Keys.
Those keys allow users to restore encrypted message histories. If attackers obtain them, they may regain access to an account even after the victim creates a new profile with the same phone number.
Reward Highlights Messaging App Risks
The UNC5792 reward shows how attackers increasingly target the identity and access layers around encrypted apps instead of attacking encryption directly.
Users should treat unexpected device-linking prompts, QR codes, recovery requests, and urgent messages with caution. For high-risk users, extra account protections and careful verification can reduce the risk of account hijacking.
0 responses to “UNC5792 Reward Offered After Russian Hackers Target Signal Accounts”