# State-Sponsored Signal Messenger Hijacking — QR Code Phishing Abusing Linked Devices, WAVESIGN Database Exfiltration, Infamous Chisel Android Malware (APT44/Sandworm, Turla, UNC5792, UNC4221, UNC1151)

> Multiple Russia-aligned threat actors (APT44/Sandworm, UNC5792, UNC4221, Turla, UNC1151/Belarus) conducting coordinated campaigns to compromise Signal Messenger accounts via QR code phishing that abuses Signal's 'Linked Devices' feature, plus direct Signal database exfiltration via WAVESIGN, Infamous Chisel, and PowerShell/Robocopy tools. Driven by Russia-Ukraine wartime intelligence demands.

- **Published:** 2026-02-16T11:24:16Z
- **Last reviewed:** 2026-02-16T11:24:16Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0111
- **ID:** TL-2026-0111
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Sandworm (Russia, Belarus)
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Google Threat Intelligence Group (GTIG) published a comprehensive report in February 2025 documenting escalating Russian state-aligned campaigns targeting Signal Messenger. The attacks exploit Signal's legitimate 'Linked Devices' feature to achieve real-time message interception without full device compromise — a novel, low-signature technique likely to proliferate beyond the Ukraine theater.

**V1 CORRECTION: The v1 title claims 'EU Officials' as primary targets. This is INACCURATE/INFLATED. GTIG documents primary targeting of Ukrainian military personnel (specifically users of the Kropyva artillery guidance app), plus politicians, journalists, activists, and other at-risk communities. While EU officials using Signal may be at risk, the DOCUMENTED targeting is overwhelmingly Ukraine-focused in the context of Russia's invasion. No specific EU official compromise incidents are documented in any primary source.**

**THE LINKED DEVICES ATTACK:**
The core technique abuses Signal's QR code-based device linking. Threat actors craft malicious QR codes that, when scanned by a victim, silently link the victim's Signal account to an attacker-controlled Signal instance. Once linked, ALL future messages are delivered synchronously to both victim and attacker in real-time. This provides persistent eavesdropping without any malware on the victim's device — no indicators on the endpoint, no compromise to detect. GTIG describes this as 'a low-signature form of initial access' with 'high risk that a compromise can go unnoticed for extended periods.'

**THREAT ACTOR BREAKDOWN (5 groups documented):**

1. **UNC5792** (overlaps CERT-UA UAC-0195) — Modified legitimate Signal group invite pages. Replaced JavaScript redirect code from 'sgnl://signal.group/' to 'sgnl://linkdevice?uuid=' URI. Hosted on actor-controlled domains like signal-groups[.]tech. Victims think they're joining a group; instead they're linking their account to the attacker.

2. **UNC4221** (CERT-UA UAC-0185) — Developed a custom Signal phishing kit mimicking the Kropyva artillery guidance application used by the Armed Forces of Ukraine. Multiple variations: (a) phishing sites redirecting to fake Signal device-linking instructions, (b) QR codes embedded directly in Kropyva-themed pages, (c) earlier 2022 operations using fake Signal security alerts. Also deployed PINPOINT JavaScript payload for geolocation collection via browser GeoLocation API.

3. **APT44 / Sandworm** (GRU, Main Centre for Special Technologies/GTsST) — Two operational modes: (a) Close-access operations enabling forward-deployed Russian military forces to link Signal accounts on BATTLEFIELD-CAPTURED DEVICES back to attacker infrastructure, (b) WAVESIGN Windows Batch script that queries Signal's SQLite database, decrypts messages using sqlcipher, and exfiltrates via Rclone.

4. **Turla** (FSB, Center 16) — Lightweight PowerShell script targeting Signal Desktop. Stages config.json and db.sqlite from %APPDATA%\Roaming\Signal, compresses to ZIP, copies to network share for exfiltration.

5. **UNC1151** (Belarus-linked) — Uses Robocopy to stage Signal Desktop directories (messages + attachments) to C:\Users\Public\data\signa for later exfiltration.

**ADDITIONAL TOOL — INFAMOUS CHISEL:**
Android malware attributed to Sandworm (SSU Ukraine + UK NCSC, 2023). Recursively searches Android devices for Signal database files and other messaging app data. Designed for battlefield device exploitation.

**SIGNAL'S RESPONSE:**
Signal cooperated with GTIG on the investigation and released hardened features on both Android and iOS to help protect against device-linking phishing. Users should update to the latest Signal version.

**BROADER IMPLICATIONS:**
GTIG warns this tradecraft will: (1) grow in prevalence, (2) proliferate to additional threat actors outside Ukraine, (3) extend to WhatsApp and Telegram which are also being targeted. The attack class — abusing legitimate multi-device features — represents a fundamental challenge because no centralized detection exists for unauthorized device linking.

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1098.001 Additional Cloud Credentials
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1560.001 Archive via Utility
- T1036.005 Match Legitimate Resource Name or Location
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.007 JavaScript
- T1567.002 Exfiltration to Cloud Storage
- T1041 Exfiltration Over C2 Channel
- T1030 Data Transfer Size Limits
- T1583.001 Domains
- T1608.005 Link Target
- T1528 Steal Application Access Token
- T1102 Web Service
- T1021.002 SMB/Windows Admin Shares
- T1199 Trusted Relationship
- T1098.005 Device Registration
- T1119 Automated Collection
- T1074.001 Local Data Staging
- T1036.004 Masquerade Task or Service
- T1070.004 File Deletion
- T1518 Software Discovery
- T1531 Account Access Removal

## Sources

- [GTIG — Signals of Trouble: Russia-Aligned Actors Targeting Signal Messenger](https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger)
- [CERT-UA — UAC-0195 Signal Account Compromise Advisory](https://cert.gov.ua/article/6278735)
- [CERT-UA — UAC-0185 Signal Phishing Kit Advisory](https://cert.gov.ua/article/6281632)
- [UK NCSC — Infamous Chisel Malware Analysis Report](https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/infamous-chisel/NCSC-MAR-Infamous-Chisel.pdf)
- [SSU Ukraine — Russian Intelligence Targeting Armed Forces Communications](https://ssu.gov.ua/en/novyny/sbu-exposes-russian-intelligence-attempts-to-penetrate-armed-forces-planning-operations-system)
- [GTIG — APT44: Unearthing Sandworm (GRU GTsST)](https://cloud.google.com/blog/topics/threat-intelligence/apt44-unearthing-sandworm)
- [US DOJ — Six Russian GRU Officers Charged (Sandworm)](https://www.justice.gov/opa/pr/six-russian-gru-officers-charged-connection-worldwide-deployment-destructive-malware-and)
- [US DOJ — Snake Malware Network Disrupted (Turla/FSB)](https://www.justice.gov/opa/pr/justice-department-announces-court-authorized-disruption-snake-malware-network-controlled)
- [UK Gov — Russia FSB Malign Activity Factsheet (Turla Attribution)](https://www.gov.uk/government/publications/russias-fsb-malign-cyber-activity-factsheet/russias-fsb-malign-activity-factsheet)
- [Signal — Linked Devices Feature Documentation](https://support.signal.org/hc/en-us/articles/360007320551-Linked-Devices)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0111