Russian Cyber Espionage Campaign Targets Government, Military, and Activists Across Ukraine, Europe, and the U.S.
Ukraine’s Security Service (SBU), in collaboration with the FBI, has uncovered a prolonged Russian cyber espionage campaign aimed at compromising the messaging accounts of government officials, military personnel, politicians, and activists in Ukraine, Europe, and the United States. The operation, designed to extract sensitive military, political, and economic intelligence, also sought to steal victims’ personal data.
Rather than exploiting vulnerabilities in messaging apps, attackers relied on social engineering tactics. One common method involved sending fraudulent text messages often in the early morning posing as official support services to trick users into revealing account credentials. The SBU noted that victims were particularly vulnerable during these hours due to fatigue or distraction.
Targets included Ukrainian government institutions, public officials, activists, and civilians, though the SBU did not disclose the specific Russian intelligence service behind the campaign, the primary messaging platforms affected, or the total number of victims. The FBI has not yet commented on the investigation.
The disclosure aligns with previous warnings from Ukraine and Western intelligence agencies about Russian efforts to infiltrate secure messaging platforms. Earlier this year, Dutch authorities reported a global campaign by Russian state-backed hackers to hijack Signal and WhatsApp accounts belonging to government, diplomatic, and military personnel, often by impersonating customer support to obtain verification codes or PINs.
Ukraine has repeatedly documented Russian espionage operations targeting military communications, including malware designed to steal data and attempts to extract encrypted Telegram and Signal messages from devices recovered on the battlefield.
Source: https://therecord.media/russia-ukraine-social-engineering-messaging-accounts
Federal Bureau of Investigation (FBI) cybersecurity rating report: https://www.rankiteo.com/company/fbi
"id": "FBI1782484133",
"linkid": "fbi",
"type": "Cyber Attack",
"date": "1/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Public Sector',
'location': 'Ukraine',
'name': 'Ukrainian government institutions',
'type': 'Government'},
{'industry': 'Government/Politics',
'location': 'Ukraine, Europe, United States',
'name': 'Public officials',
'type': 'Individuals'},
{'industry': 'Defense',
'location': 'Ukraine, Europe, United States',
'name': 'Military personnel',
'type': 'Individuals'},
{'industry': 'Civil Society',
'location': 'Ukraine, Europe, United States',
'name': 'Activists',
'type': 'Individuals'},
{'location': 'Ukraine',
'name': 'Civilians',
'type': 'Individuals'}],
'attack_vector': 'Social Engineering',
'data_breach': {'data_exfiltration': 'Yes',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Military intelligence',
'Political intelligence',
'Economic intelligence',
'Personal data']},
'description': 'Ukraine’s Security Service (SBU), in collaboration with the '
'FBI, has uncovered a prolonged Russian cyber espionage '
'campaign aimed at compromising the messaging accounts of '
'government officials, military personnel, politicians, and '
'activists in Ukraine, Europe, and the United States. The '
'operation was designed to extract sensitive military, '
'political, and economic intelligence and steal victims’ '
'personal data. Attackers used social engineering tactics, '
'including fraudulent text messages posing as official support '
'services, to trick users into revealing account credentials.',
'impact': {'data_compromised': 'Sensitive military, political, and economic '
'intelligence; personal data',
'identity_theft_risk': 'High',
'systems_affected': 'Messaging accounts (unspecified platforms)'},
'initial_access_broker': {'entry_point': 'Fraudulent text messages posing as '
'official support services',
'high_value_targets': ['Government officials',
'Military personnel',
'Politicians',
'Activists']},
'investigation_status': 'Ongoing',
'motivation': 'Espionage, Intelligence Gathering',
'post_incident_analysis': {'root_causes': 'Social engineering tactics, user '
'fatigue/distraction during early '
'morning hours'},
'references': [{'source': 'Ukraine’s Security Service (SBU)'},
{'source': 'FBI'},
{'source': 'Dutch authorities'}],
'response': {'law_enforcement_notified': 'Yes',
'third_party_assistance': 'FBI'},
'threat_actor': 'Russian State-Backed Hackers',
'title': 'Russian Cyber Espionage Campaign Targets Government, Military, and '
'Activists Across Ukraine, Europe, and the U.S.',
'type': 'Cyber Espionage'}