A hacking group allegedly linked to Russia’s government has attempted to steal WhatsApp data from employees of non-governmental organisations (NGOs) providing aid to Ukraine, according to a recent report by Microsoft Corp.
The attackers, associated with Russia’s Federal Security Service (FSB), sent targeted emails to specific individuals, inviting them to join WhatsApp groups. Microsoft researchers revealed in a blog post on January 16 that these phishing messages often appeared to be from a US government official and included a QR code that supposedly provided details about initiatives supporting Ukraine in its ongoing conflict with Russia. Microsoft did not disclose whether any of the attempted intrusions were successful.
The cyber attacks have been linked to Star Blizzard, a hacking group allegedly backed by the state, according to Microsoft. Since October, the US Justice Department, with assistance from Microsoft, has seized or taken down 180 websites associated with the group.
A WhatsApp spokesperson stated that the company protects personal conversations with end-to-end encryption and advised users to only click on links from trusted sources. The Russian Embassy in Washington did not immediately respond to a request for comment.
In December, the US Cybersecurity and Infrastructure Security Agency (CISA) reported that the Star Blizzard group is “almost certainly” linked to Russia’s FSB, citing the group’s history of attempting to compromise American and British politicians, academics, and individuals in the defence sector. CISA noted that Star Blizzard specialises in researching potential targets on social media, identifying their professional contacts, and creating email accounts that impersonate trusted associates.