Russian state-sponsored hackers are increasingly exploiting Signal’s “linked devices” feature to conduct espionage operations, particularly targeting Ukrainian military personnel, government officials, journalists, and activists. Multiple threat actors, including Sandworm, UNC5792, UNC4221, and Turla, have developed sophisticated phishing campaigns that trick victims into scanning malicious QR codes disguised as group invites, security alerts, or military-related applications like Kropyva. Once scanned, these codes link the victim’s Signal account to an attacker-controlled device, allowing real-time message interception without breaking Signal’s encryption. Some Russian groups have also gained access to Signal accounts by exfiltrating database files or deploying malware, such as Wavesign and PINPOINT, to collect user information and geolocation data. Additionally, battlefield tactics have included linking Signal accounts from captured Ukrainian devices back to Russian-controlled infrastructure for further exploitation. These techniques mirror broader Russian cyber campaigns targeting other secure messaging apps like WhatsApp and Telegram. Google and Mandiant warn that such attacks are likely to expand beyond remote phishing operations to include close-access tactics where hackers gain physical access to victims’ unlocked devices. In response, Signal has rolled out security updates to mitigate these threats, while experts recommend users adopt strong passwords, regularly audit linked devices, and keep their apps updated to protect against evolving cyber threats. CTIX analysts will continue to report an breaking threat actor news.