US warns Russia's GRU is phishing military Signal accounts; APT28 weaponises new flaws
FBI/CISA advisory targets encrypted-messaging compromise as Fancy Bear exploits a patched-by-May vulnerability
Summary
US authorities are warning that Russia's military intelligence is running a sustained Military Cyber campaign against the trusted communications of officials and troops. An FBI/Cisa joint advisory says Russian hackers are phishing to compromise commercial encrypted-messaging apps such as Signal, targeting current and former United States government officials, military personnel, political figures and journalists of high intelligence value — typically by abusing device-linking features to clone sessions. Separately, CISA added flaws exploited by Apt28 (the GRU's Fancy Bear, Unit 26165) to its Known Exploited Vulnerabilities catalog, ordering federal agencies to patch by mid-May 2026. The thread is espionage on encrypted channels rather than destructive attacks — the quiet, persistent side of the war that runs parallel to the drone and EW fight on the front.
By the numbers
- May 12, 2026 — federal remediation deadline for the APT28-exploited flaw.
- Unit 26165 — the GRU formation behind APT28 / Fancy Bear.
- 4 — high-value target classes named: officials, military, political figures, journalists.
- 200 / 80 — companies / countries an earlier China-linked (Salt Typhoon) campaign hit, for scale.
Why it matters
The campaign turns "secure" messaging into an intelligence collection surface against the people running Western defence and Ukraine policy — espionage that shapes decisions without firing a shot. It also keeps state-sponsored APTs (Russia's GRU here; China's Salt Typhoon elsewhere) at the centre of the Military Cyber threat picture.
What to watch
- Whether Signal/messaging vendors harden device-linking against session cloning.
- New CISA KEV additions tied to APT28 and agency patch compliance.
- Escalation from espionage to disruptive attacks on defence or critical infrastructure.