The Signal Key Heist: How Russian Intelligence Turns a Backup Feature Into a Persistent Account Backdoor

The attack chain has four stages, each building on the previous one. Stage one: reconnaissance. The attacker identifies a target with access to sensitive communications. Sources include public government directories, conference speaker lists, LinkedIn job titles, and intercepted metadata from prior compromises. The target's phone number is already known or obtained through a profile link or Signal's phone number search. Stage two: initial contact. The attacker sends an in-app message from a Signal account whose display name is set to "Signal Support" or a close variant. Signal does not verify support handles. The message voice mimics bureaucratic urgency: 'Your account is flagged for non-compliance with new security policies. To avoid message loss, please complete the following steps immediately.' Stage three: key extraction. The message instructs the user to navigate to Settings > Chats and Media > Chat Backups > Turn On. Signal generates a 30-word recovery key on the first backup enable. The user is asked to copy and paste it into the chat. The attacker collects it. Stage four: persistent backdoor. The attacker enters the recovery key on a device they control, restoring the target's full backup \u2014 messages, media, group histories. Because Signal binds account ownership to phone number and recovery key, the attacker can also register that number on their device, locking the legitimate user out. Even if the target regains access and generates a new key, the attacker still holds the old key and any data already downloaded. Here is a Python function that models the key's reuse behavior: ```python import hashlib def check_key_persistence(target_number, known_key, new_key): # Simulate Signal's key-binding logic (simplified) backup_hash = hashlib.sha256(f"{target_number}:{known_key}".encode()).hexdigest() new_hash = hashlib.sha256(f"{target_number}:{new_key}".encode()).hexdigest() # Old key still works because backup is encrypted with the original key material return backup_hash == backup_hash # Always True until backup is explicitly deleted known_key = "abandon frost justify leisure monitor snap kind recall genuine sausage embody try" new_key = "zebra kiosk pastry lunar gravity branch opinion violin winch obscure matrix edit" print(check_key_persistence("+15551234567

Prevention requires addressing both the user behavior and the architectural design. The steps below focus on what organizations can control today, independent of Signal's roadmap.

When an employee reports that they have handed over their Signal recovery key, the clock starts. Every minute matters. CISO: Open an incident immediately. Do not wait for confirmation. The key exfiltration is a signal that the attacker has already established contact. Escalate to legal and compliance if the target discusses sensitive data. IR Team (first 15 minutes): Instruct the user to close Signal immediately. Do not let them generate a new key or delete the app yet. The attacker may already be using the key to pull the backup; generating a new key does not stop a download in progress. Run a live capture of outbound Signal traffic from the user's device to identify any active data exfiltration. IR Team (first 60 minutes): After confirming the attacker has not established session persistence, instruct the user to disable chat backups completely in Signal settings. Then generate a new recovery key. Then delete the old backup from Signal's servers by disabling backups and re-enabling them \u2014 this forces Signal to delete the encrypted backup associated with the old key. Without this step, the old key remains valid for the deleted backup, but the backup itself is gone. Legal: Prepare a notification template for affected contacts if the account was used in sensitive group chats. The attacker had access to group metadata and member histories. Disclose to known parties. Comms: Do not issue a public statement without legal review. The attacker may use the disclosure to triangulate high-value Signal contacts \u2014 they are monitoring the user's network for response patterns. Most commonly missed action: instructing users to delete the old backup from Signal's servers. Most guidance says "generate a new key." That stops future backup access but leaves the existing encrypted backup in place. The attacker already has the key. The backup must be deleted from the server side to make the key useless.

First lesson: the attacker did not break Signal's encryption. They subverted the user's trust in the application itself. The problem is not cryptographic \u2014 it is sociological. The industry's obsession with protocol security has created a blind spot for the human protocol layer. If the app cannot prove it is talking to a legitimate endpoint, the encryption is just decoration. Second lesson: persistent credentials without expiration are a liability. The Signal recovery key is a 30-word passphrase that functions as a master key to a user's entire messaging history. There is no scope limitation, no time-bound access, no revocation mechanism that works retroactively. This is a design choice, not a bug. Every encrypted application that adopts this pattern inherits the same vulnerability. Third lesson: the playbook for stopping this attack is not technical. It is operational. Train users to treat any in-app request for secrets as hostile, regardless of the sender name. Implement a policy that no legitimate support communication ever asks for a backup key. Then test that policy with a simulation. The organizations that do this will catch the next variant before the advisory is published.