Dutch military personnel, government officials, and journalists are being targeted by Russian hackers. The hackers break into WhatsApp or Signal to monitor chat messages.
The Dutch intelligence services AIVD and MIVD issued a warning on Monday regarding a Russian hacking campaign. The hackers are attempting to gain access to the chat accounts of military personnel, government officials, and journalists worldwide. MIVD confirms that government officials in the Netherlands have fallen for the trap.
Phishing via chat applications
The Russian hackers appear particularly interested in WhatsApp and Signal. These messaging apps are known for their strong encryption, which is normally impossible to crack. Therefore, the hackers try to obtain verification and PIN codes from their targets, according to the military intelligence service. They pose as a support chatbot to request the codes and take over the account.
The hackers’ goal is to monitor the victim’s chat and group conversations. The hackers also exploit the device linking feature to read along remotely. MIVD suspects that sensitive information may have reached the hackers via the breached chat accounts.
The intelligence services have published official advice. “Despite having end-to-end encryption, chat applications such as Signal and WhatsApp are not channels for confidential or sensitive information,” emphasizes MIVD Director Vice Admiral Peter Reesink. “It is not the case that Signal or WhatsApp as entire applications have been compromised. The threat is directed at the accounts of individual users,” adds AIVD Director-General Simone Smit.
It is recommended to thoroughly check your Signal and WhatsApp contacts. Unusual names or unknown members in a group chat may indicate a compromised account. The hackers often change the name of the hijacked account to ‘Deleted Account’ to remain undetected.
Active in Europe
The Russian hackers are not only targeting the Netherlands. They are reportedly active worldwide using the same methods. In February, the German security service already warned about the campaign. No advice has been published by the Belgian State Security Service as of yet.
Messaging app Signal has also responded to the hacks itself. Via social media, Signal states that its infrastructure has not been compromised. The messaging app emphasizes that it will never ask for PIN or verification codes via SMS, and that you only need to enter the verification code when logging in for the first time.