Germany believes Russia responsible for global cyber campaign on Signal, WhatsApp, media reports
on Google
Berlin deems Russia responsible for a large-scale phishing campaign on the Signal messaging service, which included high-ranking German officials, including Bundestag President Julia Klöckner, as victims, Der Spiegel reported on April 25, citing undisclosed German government sources.
The German newspaper reported that Berlin believes that "this attack presumably originated in Russia."
Der Spiegel's report comes more than a month after the Dutch intelligence said Russian hackers launched a global cyber campaign targeting WhatsApp and Signal accounts.
The attackers reportedly used phishing tactics to persuade users in chats to disclose security verification codes and passcodes, allowing them to access personal accounts and group chats.
Signal acknowledged the reports in a social media post, saying it was aware of targeted phishing attacks that have led to some account takeovers.
"Russian state hackers are engaged in a large-scale global cyber campaign to gain access to Signal and WhatsApp accounts belonging to dignitaries, military personnel, and civil servants," the Netherlands' General Intelligence and Security Service (AIVD) said in a March 9 statement.
The American Federal Bureau of Investigation (FBI)'s Director, Kash Patel, also said in March that the bureau has identified Russian intelligence-linked cyber actors targeting messaging services, including Signal.
Russian-linked hacking groups have conducted cyber operations for decades, often focusing on financially motivated attacks such as ransomware.
Since Russia's full-scale invasion of Ukraine, however, the country's cyber activities have increasingly shifted toward more disruptive and destructive operations targeting Ukraine's Western allies.
Cyberattacks have become a central element of Russia's hybrid warfare strategy. European governments have repeatedly accused Moscow of escalating cyber operations, including attacks on Ukrainian systems, breaches of civilian infrastructure in Europe, and attempts to interfere in foreign elections.
Moscow has denied cyberattack allegations throughout the years, dismissing them as anti-Russian propaganda.
While Berlin has not disclosed the number or all the identities of the victims, at least 300 Signal accounts belonging to individuals in the political sphere were affected by the phishing campaign, Der Spiegel reported, citing information it obtained.
The investigations, Der Spiegel reported, have shown that the cyber attackers likely accessed chat histories, files sent via the messaging services, and phone numbers.
Der Spiegel reported, citing government sources, that those whose accounts were affected had been informed by the Federal Officers for the Protection of the Constitution and for Information Security, and that the affected devices have been checked to halt data leakage.
Meanwhile, Russian authorities attempted to fully block the Meta-owned WhatsApp messaging app as part of a broader strategy to tighten digital control, the social media platform said in February.
