Mass attack by Russian hackers on Dutch military personnel and civil servants

"Despite having end-to-end encryption, chat applications such as Signal and WhatsApp are not channels for classified, confidential, or sensitive information. It is not the case that Signal or WhatsApp as a whole have been compromised; the threat is to individual users' accounts. The attackers are not exploiting technical vulnerabilities in the apps themselves, but rather legitimate security features."

"The most commonly observed attack method is for hackers to pose as an official Signal support chatbot. Through these fake messages, they try to obtain victims' verification codes and PINs. With these codes, they can take over accounts. The attackers also exploit the so-called 'linked devices' feature within Signal and WhatsApp, which allows devices to be linked to an account."

"Signal is widely used by governments worldwide because of its reputation as a reliable, independent, end-to-end encrypted communication platform. This makes it an attractive target for attackers. Sensitive information is expected to be found there. Once an account has been taken over, the Russians can read incoming messages and chat groups in which the victim participates are also vulnerable to eavesdropping."

Dutch intelligence agencies MIVD and AIVD have identified an active Russian hacking campaign targeting Signal and WhatsApp accounts of government employees, military personnel, dignitaries, and journalists. The attackers exploit legitimate security features rather than technical vulnerabilities. The primary attack method involves posing as official Signal support chatbots to obtain victims' verification codes and PINs, enabling account takeover. Attackers then abuse the linked devices feature to remotely access accounts and read messages without detection. Once compromised, accounts expose chat groups and sensitive communications. Intelligence directors emphasize that despite end-to-end encryption, these applications should not be used for classified or sensitive information. The threat targets individual user accounts rather than the platforms themselves.

Read at Techzine Global