Signal is immensely popular in Ukraine, particularly among military personnel who rely on the encrypted messaging app for secure communication. However, Russian hackers have been actively attempting to infiltrate Ukrainian military Signal accounts by exploiting a notable feature of the app, as reported by Google researchers.
According to Google, Russian cybercriminals have been using malicious QR codes to target Signal accounts. This feature allows users to link their accounts across devices, but attackers can take advantage of it by sending fake QR codes that connect the victim’s Signal account to devices controlled by the hackers.
“As a result, if the attack is successful, future messages sent to the victim can also be accessed in real-time by the threat actor, allowing for eavesdropping on what would otherwise be secure conversations,” explained Dan Black, principal analyst at Google’s Threat Intelligence Group.
Google has documented a variety of attacks, including one instance where a fraudulent Armed Forces of Ukraine website prompted soldiers to scan a QR code to join a Signal group, inadvertently linking their accounts to Russian operators. The implications of such compromises are significant, as they could expose sensitive information and lead to dire consequences.
Black suspects that these attacks are being orchestrated by Sandworm, a Kremlin-linked cyber espionage group notorious for previous assaults on Ukrainian energy infrastructure. The group’s operatives have reportedly been cooperating with Russian military forces on the ground in Ukraine to access the Signal accounts of mobile devices captured during battles.
While encryption apps are essential for military communication, they can also serve as entry points for adversaries. “The very attributes that make these messaging apps essential also create vulnerabilities,” stated Black.
In addition to targeting Signal, Google discovered several Russian groups developing malware aimed at extracting Signal data from Windows and Android systems. According to Victor Zhora, a former deputy head of Ukraine’s State Service for Special Communications and Information Protection, these types of attacks have become increasingly frequent since the onset of the war, particularly through QR code phishing, known as “Qishing.”
Black noted that after Russia intensified its focus on encrypted messaging apps around the first anniversary of the invasion in early 2023, the urgency of safeguarding these platforms grew, especially with a Ukrainian counteroffensive looming.
In response to the threats, Signal has collaborated with Google to enhance the app’s security features. Signal made updates to improve user awareness about device linking, including a new interface that clearly indicates when a new device is attempting to link to the user’s account. Furthermore, users will receive notifications that enable them to easily review and remove any linked devices that they do not recognize.
Security experts also advise military personnel to be vigilant and to exercise caution with messages that convey urgency—terms like “urgent,” “emergency,” and “important” from unverified senders are common tactics employed by cybercriminals looking to exploit trust and hastiness.
For more on this topic, you can explore additional articles from Forbes detailing various cybersecurity measures and challenges during the ongoing conflict in Ukraine.
