The U.S. State Department’s Rewards for Justice program is offering up to $10 million for information leading to the identification or location of members of two Russian hacking groups — tracked as UNC5792 and UNC4221 — linked to Russia’s FSB and military intelligence services. These groups were caught running phishing campaigns designed to steal access to Signal and WhatsApp accounts belonging to government officials, military personnel, journalists covering the Russia-Ukraine conflict, and NGO workers supporting Ukraine.
For most people, this announcement is a signal that authorities are actively pursuing the attackers — and that the threat has been taken seriously at the highest level. If you covered the Signal backup key attack we wrote about yesterday, this is the formal government response: public attribution and a cash bounty for anyone with tips that help bring those responsible to account.
How to check if you’re affected
Affected devices are any phone or computer where Signal or WhatsApp is regularly used by government employees, military personnel, journalists, or aid workers involved in Russia-Ukraine-related work.
- Journalists and NGO workers: audit your active Signal and WhatsApp sessions by going to Settings → Linked Devices and removing any you don’t recognize.
- Never share a Signal recovery key or WhatsApp backup key with anyone — not support teams, colleagues, or administrators. Requests to do so are a red flag.
- Enable disappearing messages in sensitive conversations as an extra layer of protection, so older messages aren’t available even if access is briefly gained.
- Report suspicious contact claiming to be Signal or WhatsApp support to the FBI’s Internet Crime Complaint Center at ic3.gov.