The U.S. government is offering a reward of up to $10 million for information that helps identify or locate members of two Russian-linked hacking groups accused of targeting WhatsApp and Signal users.

The reward is part of the State Department’s Rewards for Justice program, which focuses on cyber threats against U.S. critical infrastructure and government organizations.

The hacker groups, tracked as UNC5792 and UNC4221, are believed to be connected to Russian intelligence and military services. According to U.S. officials, they have carried out phishing campaigns aimed at government officials, military personnel, diplomats, journalists, and other high-profile targets by abusing trusted messaging platforms rather than breaking their encryption.

Instead of attacking WhatsApp or Signal directly, the hackers use social engineering techniques. They impersonate customer support representatives and trick victims into sharing verification codes or Signal Backup Recovery Keys, allowing attackers to access private conversations, contact lists, and group chats. Recent intelligence shows the groups have shifted their focus toward stealing recovery keys because they can provide long-term access to message backups.

The U.S. government is seeking information about the identities of the hackers, their locations, links to Russian intelligence agencies, operational infrastructure, financial networks, cryptocurrency wallets, and anyone helping to support their cyber operations. Authorities hope the reward will encourage people with valuable information to come forward.

The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) recently updated an earlier advisory warning that these attackers continue to evolve their phishing tactics. Officials urge WhatsApp and Signal users, especially those in government, media, and other sensitive sectors, to be cautious of unexpected messages requesting verification codes, backup recovery keys, or device-linking approvals, as these are common methods used to hijack secure messaging accounts.

READ
Fake CAPTCHA Tricks Mac Users Into Installing Atomic Stealer Malware


Buy ExpressVPN with PayPal or Credit Card
Advertisement