US Offers $10M for Russian Hackers Targeting Journalists

Federal authorities are offering a substantial reward of up to $10 million for information that could identify or locate a Russian state cyber group. This group has been actively compromising thousands of Signal and WhatsApp accounts since at least March. The targets primarily include investigative reporters and US government employees.

The sophisticated phishing campaigns, warned about by the FBI since March, trick users into providing verification codes or account passcodes. Initially, attackers could read new messages sent to compromised accounts, though Signal's safety features prevented access to past conversations. The operation is linked to Russian intelligence services and tracked under the designations UNC5792 and UNC4221.

Recently, the campaign evolved to trick users into creating account backups and then sharing the encryption passcodes. This allows attackers to access past Signal conversations. The US State Department's Reward for Justice program is seeking information on these groups, specifically UNC5792, associated with Russian FSB Border Guards, and UNC4221, linked to Russian military services.

Despite the advanced encryption of platforms like Signal, phishing remains a potent threat. The FBI advises users who may have compromised their backup keys to generate a new one. However, this action does not erase backups already downloaded by the actors. A key takeaway for users is to resist the urge to act immediately on suspicious messages, as there is rarely a penalty for verification.