The United States government has announced a reward of up to $10 million for information leading to the identification or location of members of two Russia-linked cyber groups accused of conducting large-scale attacks against Signal and WhatsApp users. The campaign has reportedly targeted government officials, military personnel, journalists, diplomats, and policy experts across multiple countries.
The reward is being offered through the US State Department’s Rewards for Justice programme, reflecting growing concerns over sophisticated cyber-espionage operations targeting encrypted messaging platforms.
Thousands of Accounts Reportedly Compromised
According to US authorities, the groups known as UNC5792 and UNC4221 have been active since at least March 2026. Investigators say the attackers have successfully compromised thousands of messaging accounts belonging to high-value targets, including current and former government officials and members of allied organisations.
The cyber groups are believed to have links with Russian intelligence and military services. US officials allege that the campaigns were designed to gain access to sensitive communications, contact networks, and private group discussions.
How the Attacks Worked
Importantly, investigators say the attackers did not break the encryption used by Signal or WhatsApp. Instead, they relied on social engineering techniques to trick users into granting access to their accounts.
The hackers reportedly impersonated support personnel and sent messages requesting verification codes, backup recovery keys, or account credentials. In other cases, they exploited legitimate device-linking features by directing victims to fake invitation pages that secretly connected attacker-controlled devices to the target’s account.
Once access was obtained, the attackers could monitor new conversations, view contact lists, and launch further phishing attacks using the compromised accounts.
Growing Concern Over Messaging App Security
The campaign highlights a growing trend in cybersecurity where attackers focus on manipulating users rather than breaking technical protections. Security agencies emphasised that the encryption mechanisms of both Signal and WhatsApp remain secure, but human error continues to be a major vulnerability.
Recent advisories from the FBI and other agencies also warned that attackers have begun targeting backup recovery keys, potentially allowing future access to accounts even after victims attempt to recover them.
US Seeks Intelligence on Hacker Networks
As part of the reward programme, US authorities are seeking information on the hackers’ identities, locations, operational infrastructure, funding sources, cryptocurrency wallets, and connections to Russian intelligence agencies. Officials hope the bounty will generate actionable intelligence that can help disrupt future cyber operations.
The announcement underscores the increasing role of cyber warfare in international security and the growing efforts by governments to counter state-linked hacking campaigns targeting critical communications.
Summary
The US government has offered up to $10 million for information on two Russia-linked hacking groups accused of compromising thousands of Signal and WhatsApp accounts. Rather than breaking encryption, the attackers used phishing and social engineering tactics to gain access to sensitive communications. The move highlights growing concerns over cyber espionage targeting government officials, journalists, and security personnel worldwide.
