The US State Department is putting a $10 million price tag on two Russian hacking crews accused of breaking into the Signal and WhatsApp accounts of government officials, military officers, and journalists around the world. The reward, announced through the State Department’s Rewards for Justice program on June 27, 2026, targets two groups tracked as UNC5792 and UNC4221, both linked to Russian intelligence and military services.
The FBI and the Cybersecurity and Infrastructure Security Agency paired the bounty with an updated advisory describing how the campaign has changed since it first surfaced in March 2026. The hackers no longer just chase one-time verification codes. They now go after Signal Backup Recovery Keys, a credential that can hand a victim’s entire message history to an attacker on a device the victim never touched.
Neither Signal’s nor WhatsApp’s encryption has been broken. Every account compromise described in the advisory came from phishing and social engineering, not a software flaw. That distinction shapes how organizations should respond, and it explains why the reward now names two specific groups instead of issuing another general warning about Russian state hacking.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What the $10 Million Reward Actually Covers
The Rewards for Justice program, run out of the State Department’s Bureau of Diplomatic Security, is offering up to $10 million for information that helps identify or locate members of UNC5792 and UNC4221. News of the reward broke on June 27, 2026 and spread quickly through security outlets including BleepingComputer and Security Affairs, with SecurityWeek confirming the same $10 million figure on June 29, 2026 and gHacks reporting the offer the following day, June 30, 2026, and it ties directly to violations of the Computer Fraud and Abuse Act.
“Rewards for Justice is offering a reward of up to $10 million for information leading to the identification or location of any person who, while acting at the direction or under the control of a foreign government, participates in malicious cyber activities against U.S. critical infrastructure in violation of the Computer Fraud and Abuse Act.”
Investigators aren’t just asking for names. The bounty specifically covers five categories of intelligence: identities and biographical detail on group members and their contractors, documented links to Russian intelligence services, the servers and domains and tools that power the operation, funding sources and banking relationships, and cryptocurrency wallets tied to the group’s activity. That last category shows up in nearly every recent Rewards for Justice cyber offer, a reflection of how much state-linked hacking now runs on crypto rails for payment and laundering.
Tips can come from anyone, anywhere, through the program’s secure reporting channels. Informants don’t need to hold US citizenship or live in the country. The program has a real track record of paying out too: as of 2022, Rewards for Justice had paid more than $250 million to 125 people since its creation in 1984, a figure that spans its counterterrorism and cyber mandates combined.
Who Are UNC5792 and UNC4221
UNC5792 and UNC4221 are tracking labels, the kind of shorthand the security industry uses for a threat cluster whose full membership and command structure aren’t public yet. UNC5792 is attributed to the FSB Border Guards Service, a division of Russia’s Federal Security Service. UNC4221 is described as working on behalf of Russian military intelligence, with reporting from Escudo Digital pointing to operations concentrated across Europe and Eurasia rather than one single target country.
Both names went public for the first time in the June 2026 advisory. That timing matters. The phishing campaign itself had been tracked quietly since at least March 2026, when the Netherlands’ AIVD and MIVD intelligence services first disclosed that Dutch government employees had been targeted in a nearly identical scheme. The FBI and CISA issued their own joint advisory around the same time, describing Russian Intelligence Services actors going after what they call commercial messaging applications, without naming specific groups.
Attaching names to the activity three months later reads as a deliberate escalation. It tells allied intelligence agencies they now have enough confidence in their attribution to put it on the record, and it gives the reward program a specific target instead of a vague call for tips on “Russian hackers” in general.
From Verification Codes to Backup Recovery Keys
The tactical shift documented in the June update is the most consequential part of this story for anyone who relies on Signal or WhatsApp for sensitive conversations.
Early versions of the campaign, according to the FBI and CISA, focused on stealing one-time verification codes and account PINs, the kind of credential that grants access for a single login. That’s damaging, but the window is narrow. Once an account owner notices and re-secures the app, the stolen code becomes worthless.
The June advisory says the threat actors have moved on to something more durable, as reported by Infosecurity Magazine:
“Russian Intelligence Services (RIS) cyber-threat actors continue to masquerade as automated CMA support accounts in updated phishing messages but have evolved their tactics to attempt to elicit victims’ Backup Recovery Keys.”
A Backup Recovery Key isn’t a login credential. It’s a restoration key. Whoever holds it can pull down a full copy of a victim’s backed-up message history, including private and group conversations, onto a brand-new device, at any point in the future. The advisory spells out the consequence directly:
“If a targeted user backs up their CMA messages âĶ and later provides their Backup Recovery Key, RIS cyber threat actors can view the account’s historical messages, private and group messages, and take over the victim’s account.”
That’s a different threat model than a stolen password or a one-time code. It survives a victim buying a new phone. It survives reinstalling the app entirely. The only real fix is generating a fresh key, and even that carries a catch the FBI states plainly: rotating the key “does not prevent the actor from having already downloaded a backup of the original account.”
Inside the Phishing Playbook
None of this required breaking Signal’s or WhatsApp’s encryption. Every technique described across the advisories relies on tricking a person, not defeating a cipher.
The core method has attackers impersonating automated support accounts inside Signal and WhatsApp, sending direct messages claiming the recipient must complete a mandatory two-factor verification process. Victims who comply hand over verification codes, account PINs, or, in the newer wave of attacks, their Backup Recovery Key.
A second technique abuses a legitimate feature rather than a fake message. Signal’s linked-devices function lets one account run on a phone and a laptop at once, by design. UNC5792 and UNC4221 have used social engineering to get victims to approve a “linked device” that actually belongs to the attacker, handing over live access to the account without touching a password at all.
A typical lure, reconstructed from the pattern described in FBI, CISA, and Dutch
intelligence advisories, follows this structure:
"[Signal/WhatsApp] Support: Your account requires mandatory two-factor
verification to remain active. Reply with your verification code or Backup
Recovery Key to confirm your identity and avoid suspension."Security Affairs reports a third variant on top of those two: hackers modifying legitimate Signal group invite pages so a real-looking invite link redirects the victim to a malicious page instead. Combine fake support messages, abused device-linking, and doctored invite links, and you get what US officials describe as compromise of “thousands of individual accounts,” achieved with zero exploit code, the same tactic family covered in this outlet’s reporting on evil twin Wi-Fi attacks and other social-engineering schemes that skip the technical break-in entirely.
Why a Stolen Backup Key Beats a Stolen Password
It helps to compare what each stolen credential actually buys an attacker. A stolen password, on its own, usually gets stopped by two-factor authentication. A stolen one-time verification code gets an attacker into a single session, until the victim notices and logs back in. A stolen Backup Recovery Key works differently. It doesn’t expire when the victim changes a password, switches phones, or reinstalls the app. It sits with the attacker as a standing archive of every backed-up message, ready to be restored on demand.
That’s why coverage of this campaign keeps circling back to the same framing: this isn’t a break-in, it’s a long-term surveillance capability. A compromised verification code is a burglar who got in once. A compromised backup key is a burglar who copied the house key and can let themselves in whenever they want, from a country the victim will never visit.
For the population targeted here, diplomats, military officers, journalists covering Russia and Ukraine, that distinction defines the whole story. One successful phish doesn’t just expose a single conversation. It can expose months or years of message history, contact lists, and group chats involving people who never clicked on anything themselves.
Who Is Being Targeted
The Rewards for Justice announcement lists the affected population in detail, and it reads less like a random spray of phishing and more like a curated intelligence-collection target list. Named categories include current and former US government officials, diplomatic and foreign affairs personnel, defense and national security staff, policy analysts and advisors, NATO member-state officials and diplomats, allied intelligence and defense partners, investigative journalists covering Russia, Ukraine, and international affairs, non-governmental organizations supporting Ukraine, and academic researchers focused on security studies and Russian affairs.
Geographically, the disclosed victims span the United States, the Netherlands, and Ukraine, with additional reporting pointing to a broader European and Eurasian footprint tied specifically to UNC4221.
What ties the list together isn’t nationality. It’s proximity to two subjects: Western government decision-making and Russia’s war in Ukraine. A defense contractor, a NATO diplomat, and a freelance war correspondent have little in common professionally, but each one might carry sensitive, unpublished information about Russian military conduct or Western policy responses to it. That’s the profile the two groups appear to be optimizing for, consistent with what researchers have documented from FSB and GRU-linked units for years: collection against people, not just systems.
Timeline: From a Dutch Warning to a $10 Million Bounty
Piecing together public disclosures from three governments and half a dozen security outlets, the campaign’s escalation looks like this:
| Date | Event |
|---|---|
| March 2026 | Netherlands’ AIVD and MIVD intelligence services disclose a Signal and WhatsApp phishing campaign targeting Dutch government employees |
| March 2026 | FBI and CISA issue a joint advisory on Russian Intelligence Services targeting commercial messaging apps, without naming specific groups |
| Mid-to-late June 2026 | FBI and CISA update the advisory, revealing the shift toward stealing Signal Backup Recovery Keys |
| June 27, 2026 | State Department’s Rewards for Justice program announces up to $10 million reward and publicizes the UNC5792 and UNC4221 tracking names |
| June 29, 2026 | BleepingComputer, Security Affairs, and other outlets report on the bounty and the updated advisory |
| Ongoing | Rewards for Justice tip line stays open for information on group members, contractors, infrastructure, and funding |
UNC5792 vs. UNC4221: Threat Actor Snapshot
Public reporting treats the two groups as a linked pair more often than as separate operations, but a few distinctions have surfaced.
| Attribute | UNC5792 | UNC4221 |
|---|---|---|
| Attributed sponsor | Russian FSB Border Guards Service | Russian military intelligence services |
| Platforms targeted | Signal, WhatsApp | Signal, WhatsApp |
| Core tactic | Fake support-account phishing for codes, PINs, and Backup Recovery Keys | Same phishing playbook, plus abuse of device-linking and group-invite links |
| Reported focus | US, NATO, and allied government and military personnel, plus journalists | Broader European and Eurasian operations, Ukrainian officials included |
| Publicly named since | June 2026 (activity tracked since at least March 2026) | June 2026 (activity tracked since at least March 2026) |
| Reward offered | Up to $10 million, shared bounty covering both groups | Up to $10 million, shared bounty covering both groups |
Not Washington’s First $10 Million Russia Bounty
The size of this reward is no coincidence. Ten million dollars has become the State Department’s standard figure for the most serious state-linked cyber cases, and by July 2026 Rewards for Justice had used that exact number against Russia-connected hackers at least six times in under five years, with SecurityWeek and State Department disclosures showing the $10 million figure functioning as a de facto cap per actor or group rather than a one-off headline number.
In November 2021, following the Colonial Pipeline attack that triggered gas shortages along the US East Coast, the State Department offered up to $10 million for information on the DarkSide ransomware group. In April 2022, it offered the same amount for six Russian GRU officers tied to the Sandworm hacking unit, a group publicly linked to some of the most disruptive cyberattacks in Ukraine’s history. The pace only picked up from there: in June 2025, State put the same $10 million bounty on RedLine infostealer creator Maxim Rudometov, and by September 4, 2025 it had offered another $10 million for three FSB officers, identified as Tyukov, Gavrilov, and Akulov, tied to more than 500 energy-sector hacks. Now, in 2026, the same figure applies to UNC5792 and UNC4221.
The pattern says something about how Washington calibrates these rewards. A general warning about Russian state-sponsored hacking doesn’t move much. Naming two specific groups, with a specific dollar figure attached, aims to fracture trust inside the operation. Ten million dollars is a meaningful incentive for a disgruntled contractor, a struggling intermediary, or anyone adjacent to the group with knowledge of its infrastructure or funding. Whether it works is a separate question. None of the five prior $10 million Russia-linked rewards, including the June 2025 offer for RedLine’s Rudometov and the September 2025 offer for the FSB’s Tyukov, Gavrilov, and Akulov, has produced a publicly confirmed arrest inside Russian territory, which stays largely outside US law enforcement reach absent extradition cooperation Moscow has shown no interest in offering. The pattern kept running past this campaign, too: following a March 2026 indictment tied to the Media Land/ML Cloud bulletproof-hosting operation, Rewards for Justice was by July 14, 2026 offering up to $10 million plus relocation assistance for tips on three more Russian nationals, Pankova, Volosovik, and Zatolokin, whom the DOJ says caused more than $62 million in losses. The FBI’s parallel record of dismantling attacker infrastructure abroad, including its recent takedown of the NetNut proxy botnet, shows the disruption side of that strategy working better than the arrest side.
Market Impact: Secure Messaging Under Pressure
This case lands at an awkward moment for the secure-messaging category. Signal has spent the past several years positioning itself as the default choice for governments, journalists, and enterprises that need conversations to stay private, a reputation built almost entirely on the strength of its encryption protocol.
The UNC5792 and UNC4221 campaign doesn’t undercut that reputation on technical grounds. Encryption isn’t what failed here. But it does complicate the pitch. Enterprise security teams evaluating messaging platforms now have to treat account-recovery workflows and device-linking features as attack surface, not just the transport encryption that usually headlines a vendor comparison.
Expect that shift to show up in how security vendors and IT departments talk about messaging app deployment for regulated and high-risk staff, with more emphasis on locking down backup keys, restricting device-linking approvals, and treating any in-app “support” message as hostile by default, since neither Signal nor WhatsApp support ever contacts users that way. For the wider identity and access management market, this adds one more data point to a trend already underway: attacker focus is shifting from cracking cryptography toward hijacking the recovery and account-linking flows that sit around it. That’s the same soft spot driving the industry’s push toward passkeys and hardware-backed authentication as replacements for anything that can be phished out of a user.
Signal vs. WhatsApp vs. Telegram: Comparing the Backup Key Risk
The three big encrypted or semi-encrypted messengers don’t handle this risk the same way. Signal’s backup system is opt-in and tied to a PIN or a generated Backup Recovery Key. Lose control of that key and, per this campaign, someone else can restore your history to their own device. WhatsApp’s backup encryption works on a similar principle, protecting cloud backups with a password or a 64-digit recovery code rather than relying on the app’s underlying end-to-end encryption for that layer.
Telegram takes a different approach by default. Regular cloud chats aren’t end-to-end encrypted at all. They’re encrypted in transit and at rest on Telegram’s own servers, with true end-to-end encryption reserved for opt-in Secret Chats. That makes Telegram’s default mode a different threat model entirely: less reliant on tricking a user into surrendering a recovery key, more reliant on trusting Telegram’s server-side security instead. None of the three models is immune to social engineering. Each one just moves the weak point to a different part of the account-recovery process, which is exactly where UNC5792 and UNC4221 have chosen to focus their effort.
What the FBI and CISA Are Telling Users
Beyond attribution, the joint advisory doubles as a user-facing warning. The core guidance stays consistent across every outlet that covered it: legitimate support for Signal and WhatsApp does not operate the way these phishing messages claim.
- Real commercial messaging app support teams only communicate through official company email addresses, never through in-app direct messages.
- Legitimate support will never ask for a verification code inside the app.
- Legitimate support does not send links asking a user to “verify,” “restore,” or “reactivate” an account.
- Any message requesting a Backup Recovery Key should be treated as an attack, regardless of how official it looks.
The FBI’s advisory adds one more piece of remediation guidance worth repeating exactly, because the caveat at the end matters as much as the instruction itself: generating a new Backup Recovery Key in the app’s settings invalidates the old one for future backups, but it does nothing to undo a backup an attacker already pulled down before the key was rotated. That’s not a knock on Signal’s design. Every backup system built for convenience carries some version of this tradeoff. It’s a reminder that rotating a credential after a suspected compromise limits future damage without erasing past exposure.
Five Predictions for What Happens Next
- More group-specific rewards. Expect Rewards for Justice to keep naming individual UNC-tracked clusters rather than issuing broad nation-state warnings, continuing the pattern set by the DarkSide and Sandworm cases.
- Backup-key hardening becomes a vendor priority. Signal and Meta face pressure to add friction, such as mandatory re-authentication or biometric confirmation, before a Backup Recovery Key can restore an account to a new device.
- Government agencies tighten messaging app policy. Expect fresh guidance from CISA or allied agencies restricting how officials handle in-app “support” messages and device-linking requests, especially for staff covering Ukraine or Russia.
- No public arrests inside Russia. Consistent with the DarkSide and Sandworm precedents, a $10 million reward is unlikely to produce an extradition as long as those involved stay inside Russian jurisdiction.
- More joint disclosures with European partners. The Dutch AIVD and MIVD role in surfacing this campaign in March 2026 suggests future advisories will keep pairing US agencies with European counterparts, widening diplomatic pressure even where prosecution isn’t realistic.
How to Protect Your Accounts Right Now
For anyone in a role that touches government, defense, journalism, or Ukraine-related work, a few concrete steps cut most of the risk described in this campaign.
- Treat every in-app “support” message as fake by default. Signal and WhatsApp support never initiates direct contact this way.
- Never share a verification code, PIN, or Backup Recovery Key with anyone, including a message that claims to be an automated system.
- Rotate your Backup Recovery Key periodically, and immediately if you suspect any phishing contact, understanding that rotation stops future access but not a backup already taken.
- Scrutinize device-linking approval prompts. If you didn’t just try to link a new device yourself, deny the request and change your key.
- Avoid clicking group invite links sent unexpectedly, even ones that look like they come from a real contact or group.
- For high-value accounts, move past SMS or app-based codes entirely and adopt TOTP-based multi-factor authentication or hardware-backed passkeys, which resist this style of phishing far better than a code a user can be tricked into reading aloud.
None of this requires special technical skill. It requires treating a messaging app’s recovery system with the same suspicion most people have learned to apply to password reset emails, since the two attack surfaces now look a lot alike.
Frequently Asked Questions
What is Rewards for Justice?
Rewards for Justice is a US State Department program, run by the Bureau of Diplomatic Security, that pays for information leading to the identification or capture of people involved in terrorism or, in recent years, state-sponsored cyberattacks on US critical infrastructure. It dates back to 1984 and has paid out more than More than $250 million to over 125 people since 1984.
Who are UNC5792 and UNC4221?
They are tracking names for two Russian-linked hacking groups. UNC5792 is attributed to the FSB Border Guards Service. UNC4221 is described as working on behalf of Russian military intelligence. Both were publicly named for the first time in the June 2026 advisory tied to this reward.
Did the hackers break Signal’s or WhatsApp’s encryption?
No. US officials have been explicit that the campaign relied entirely on phishing and social engineering. Encryption on both platforms remained intact throughout.
What is a Signal Backup Recovery Key?
It’s a credential that lets a user restore their backed-up message history to a new device. Anyone who obtains it can pull down a victim’s historical messages, contacts, and group chats at any point in the future, which makes it far more valuable to an attacker than a one-time verification code.
How many accounts were compromised?
US authorities describe the campaign as having compromised “thousands of individual accounts” on commercial messaging apps, without publishing a precise total.
Is this the first time the US has offered $10 million for Russian hackers?
No. The State Department offered the same amount for the DarkSide ransomware group in November 2021 and for six Russian GRU officers linked to the Sandworm hacking unit in April 2022, then again in June 2025 for RedLine creator Maxim Rudometov and in September 2025 for three FSB officers tied to over 500 energy-sector hacks. The UNC5792 and UNC4221 reward is at least the sixth $10 million offer tied to Russian hacking activity since 2021, with a seventh following in July 2026 for three Russian nationals behind the Media Land hosting operation.
What should I do if I think my account was targeted?
Generate a new Backup Recovery Key immediately in your app settings, review linked devices and remove any you don’t recognize, and report the phishing attempt to the platform. Rotating the key stops future restoration but won’t undo a backup already taken before you acted.
Can I actually collect the $10 million reward?
Anyone with verifiable information on the identities, infrastructure, or funding behind UNC5792 or UNC4221 can submit a tip through the Rewards for Justice program’s secure channels. The program accepts tips from any country and has a documented history of paying informants for past cases.
For more cybersecurity coverage, visit tech-insider.org’s Cybersecurity section.
