Why a single Signal recovery key is a preservation problem

Editor’s Note: Russian intelligence operators have quietly raised the stakes on encrypted messaging. In a June 26 update to a March advisory, the FBI and CISA reported that the actors behind an ongoing Signal phishing campaign now coax targets into surrendering their backup recovery key, the credential that decrypts an account’s backed-up message archive. Encryption stays intact; the human holding the account does not.

This matters well beyond the intelligence community. The same backup that an attacker covets is the backup a regulator or court can demand. Off-channel enforcement has already cost U.S. financial firms over $2 billion since 2021, and preservation duties now reach Signal and similar tools by name. For cybersecurity, data privacy, regulatory compliance and eDiscovery professionals, an account takeover is no longer a confidentiality footnote; it is a governance event with breach-notification and discovery consequences.

Watch three things next: whether the recovery-key tactic spreads to WhatsApp and Telegram, how regulators treat compromised personal-device archives in scope, and how fast defensible mobile-collection tooling moves from option to expectation.

Industry News – Cybersecurity Beat

Why a single Signal recovery key is a preservation problem

ComplexDiscovery Staff

The FBI and CISA warned that Russian intelligence operators have added a step to their Signal phishing campaign: tricking targets into surrendering the backup recovery key that unlocks the account’s backed-up message history.

The shift turns a confidentiality problem into a preservation problem, and it puts the encrypted messages of executives, counsel and government officials within reach of anyone who can talk a target out of a single string of characters.

The two agencies published the update June 26 as Public Service Announcement I-062626-PSA, revising a March 20 advisory on Russian phishing of commercial messaging accounts. The earlier notice cataloged operators posing as Signal support to harvest one-time verification codes, account PINs and device-linking invitations. The June update describes a colder objective. The lure now coaxes a target into switching on message backups and copying the recovery key into the conversation, handing the operator the credential that decrypts the archive.

A new step in an old playbook

Once a target shares the key, the advisory said, the operator can rebuild the account’s backup and page through its private and group history; the agencies add that the stolen key can also enable takeover of the account, though full takeover in practice may still hinge on steps such as device linking or re-registration. The agencies attributed the operation to several Russian Intelligence Services clusters, among them Federal Security Service (FSB) officers attached to the FSB Border Guards and operators acting for the Russian military. The update assigned two public tracking names absent from the March notice: UNC5792 and UNC4221.

The intended victims have not shifted. According to the bureau, the roster runs from sitting and former government officials in the U.S. and abroad to military personnel, journalists, political figures and key officials in Ukraine, a group it characterizes as holding high intelligence value. The March advisory characterized the broader campaign as affecting “thousands” of accounts around the world. As of late June, the agencies said operators are still fishing for verification codes and PINs in addition to the new recovery-key request.

Why the recovery key changes the math

The first version of this scam went after a single moment of access. A stolen verification code or a booby-trapped linked-device QR code let an attacker mirror a target’s messages from that point forward, at least until the victim spotted the rogue device and cut it loose. The recovery key is a different kind of prize. It decrypts the backup archive, which means the full back catalog of a conversation, not just whatever arrives next.

It also persists, within limits. The advisory warned that a shared recovery key stays valid even after the victim creates a new account on the same phone number, and said the actor could potentially use it to compromise that new account’s backups later. The exposure attaches to backups tied to the leaked key, not to live, ongoing access once a fresh key is generated. Producing a new key in Settings cancels the prior one for any future backup download, though it cannot claw back an archive the attacker has already taken. The cryptography is never defeated in any of this. What fails is the account, and the failure runs through whoever can be persuaded to surrender the key.

From a confidentiality risk to a discovery problem

For legal, compliance and information governance teams, the escalation effectively turns a confidentiality issue into a preservation question, an implication the advisory itself does not take up. If an adversary can reconstruct a custodian’s complete Signal history, legal and forensic teams may also have to weigh whether that same history is within scope, preserved, recoverable and subject to production when the custodian falls within an investigation, a litigation hold or a regulatory inquiry. The same archive that makes the attack valuable can also matter to the legal process where it exists within a custodian’s or an organization’s possession, custody or control, and that sharpens a preservation duty regulators and courts have pressed for years.

U.S. securities and commodities regulators have imposed over $2 billion in off-channel communications and recordkeeping penalties since 2021, and the FTC and DOJ have updated merger-review guidance to remind parties that the duty to preserve reaches Signal, Telegram and similar tools. The message for practitioners is consistent: data that lives on a phone in an encrypted app is not beyond the reach of a litigation hold, and treating it as untouchable invites sanctions.

That pressure is already shaping the vendor market. On June 15, HaystackID launched a tool it calls Compliance Oversight for Mobile Electronic Transmissions, or COMET, pitched as scheduled, recurring collection of business mobile communications for regulated organizations. The company showcased it days later at the LegalTechTalk conference in London. The product takes aim at off-channel enforcement by the U.K. Financial Conduct Authority, Germany’s BaFin, France’s AMF and the European Securities and Markets Authority, a wave of activity that mirrors U.S. action.

Disclosure: ComplexDiscovery OÜ’s editor and managing director, Rob Robinson, also serves as chief marketing officer of HaystackID and covers events for Newsline by HaystackID. HaystackID is referenced here as a market participant responding to off-channel communications enforcement; the product claim is based on the company’s June 15 announcement.

The attribution and the bounty

The naming of UNC5792 and UNC4221 aligns the advisory with clusters previously documented in private research. Google’s Threat Intelligence Group had tracked UNC5792 abusing Signal’s linked-device feature in early 2025, and the group later saw the same tradecraft surface against WhatsApp and Telegram. Dan Black, a principal analyst at the group, said at the time that Signal had hardened its linked-device feature in response to the findings.

The group warned that the problem would spread. “We anticipate the tactics and methods used to target Signal will grow in prevalence in the near-term and proliferate to additional threat actors and regions outside the Ukrainian theater of war,” Google’s Threat Intelligence Group said. The State Department, through its Rewards for Justice program, has posted a bounty of as much as $10 million for information that identifies UNC5792.

The U.S. warning sits alongside earlier alerts from Dutch intelligence services, Germany’s domestic intelligence agency and cyber authority, and France’s ANSSI, each tracking variations of the same social-engineering pattern across allied governments.

What practitioners should do now

The defensive playbook is unglamorous and immediate. Any in-app note claiming to come from Signal support should be read as an attack, since the real support channel does not reach users inside the app to request codes, PINs or a recovery key. No legitimate process asks for those credentials to be typed into a conversation, so none should ever be entered there. Users can audit the linked-devices list under Settings and remove any session they cannot account for. And anyone who already pasted a key should rotate it without delay, then treat every backup made beforehand as exposed.

For organizations whose executives and counsel run sensitive matters over Signal, the update reframes incident-response and breach-notification analysis, because a compromised account can expose a deep archive rather than a single thread. It also reinforces the case for scheduled, defensible mobile-communications collection, so that the legitimate record exists in a governed system before a dispute or a regulator asks for it.

The advisory leaves organizations with a practical question: whether sensitive mobile communications are being governed and preserved before a compromised account, a litigation hold or a regulatory inquiry turns them into evidence.

News sources

• Russian Intelligence Services Continue to Target Commercial Messaging Applications  (Internet Crime Complaint Center)
• FBI Warns Russian Intelligence Hackers Target Signal Backup Recovery Keys  (The Hacker News)
• FBI, CISA issue PSA on Russian intelligence campaign to target messaging apps  (CyberScoop)
• Signals of Trouble: Multiple Russia-Aligned Threat Actors Actively Targeting Signal Messenger  (Google Cloud)
• FBI: Russian hackers now target Signal backup recovery keys  (BleepingComputer)
• HaystackID Unveils New Compliance Oversight for Mobile Electronic Transmissions (COMET)  (PR Newswire)

Assisted by GAI and LLM technologies

Additional reading

• Europe’s critical sectors are maturing, but seven still sit in ENISA’s risk zone
• When the worm targets the assistant: Miasma turns AI coding agents into the trigger
• Glasswing widens: Anthropic puts Mythos inside power, water and hospital operators across more than 15 countries
• Canvas breach moves from disclosure to demand as ShinyHunters sets May 12 deadline
• CISA’s CI Fortify rewrites the disconnection playbook for critical infrastructure
• A 48-month federal benchmark resets the incident-response insider question
• Data collection in occupied territory: A closer read of Cyber Law Toolkit scenario 35
• Cyber Law Toolkit tests surveillance and data collection under occupation
• The router on the shelf is now a national security problem
• Invisible by design: NATO’s 2026 cognitive warfare paper and the crisis of discovery
• When Your Legal Tech Vendor Gets Breached: DocketWise Incident Exposes 116,666 Immigration Records and a Profession’s Blind Spot
• The DOJ’s Cyber FCA Playbook Is Working as Enforcement Triples and Shows No Signs of Slowing
• FTC’s OkCupid Action Reframes AI Training Data as a Consumer Protection Issue
• White House AI Framework Signals New Compliance Stakes for Legal, Cybersecurity, and eDiscovery
• The Gatekeeper’s Key: How the Conformity Assessment Unlocks the EU AI Market

Source: ComplexDiscovery OÜ

ComplexDiscovery’s mission is to enable clarity for complex decisions by providing independent, data‑driven reporting, research, and commentary that make digital risk, legal technology, and regulatory change more legible for practitioners, policymakers, and business leaders.