Russia-linked hackers target Signal, WhatsApp of officials globally

Key Points:

• Russian-linked hackers are targeting Signal and WhatsApp accounts of government and military officials globally, using social engineering tactics to compromise accounts.
• The impact includes potential exposure of sensitive communications among national security actors, with specific targeting of Dutch government employees and possibly journalists.
• Recommended actions include monitoring group chats for signs of compromised accounts, reporting suspicious activity, and verifying contacts through alternative channels.

Technical Details: Attackers exploit the legitimate "linked devices" feature of Signal by using malicious QR codes to link victims' accounts to attacker-controlled devices, allowing real-time eavesdropping on secure conversations.

MITRE ATT&CK Techniques:

• T1566.001 - Phishing: Spearphishing Link (Initial Access)
• T1071.001 - Application Layer Protocol: Web Protocols (Command and Control)
• T1203 - Exploitation for Client Execution (Execution)

IOCs Mentioned: None mentioned