Security3 min read
FBI and CISA Warn Russian Intelligence Hackers Now Target Signal Backup Recovery Keys
Tags Infrastructure · Enterprise · Consumer
The Hacker News·
The FBI and CISA updated their March 2026 warning about Russian intelligence operators evolving their Signal account compromise tactics to target Signal Backup Recovery Keys. Once obtained, attackers can restore full message history and permanently compromise the account even after the user changes credentials. The campaign targets government officials, military personnel, and activists across Ukraine, Europe, and the United States using fake support SMS messages.
Technical significance
Signal's recovery key architecture has a design weakness: a single key grants permanent access. Organizations relying on Signal for sensitive communications need to rotate recovery keys and monitor for unauthorized account restores.