The United States Department of State once again put the spotlight on the silent war being waged on encrypted messaging, and did so with a reward of up to $10 million for information that helps identify or locate members of two hacker groups linked to attacks against Signal and WhatsApp.

The measure is part of the Rewards for Justice program and targets actors known as UNC5792 and UNC4221, identified by authorities as part of operations aligned with Russian interests.

The US government's bet is not minor. It seeks to gather useful data about the people behind those campaigns, from names and locations to technical infrastructure, domains, servers, hosting providers and funding sources. In other words, it's not just about putting a face to the attackers, but also about dismantling the network that allows them to operate. That kind of information often makes the difference between a threat that continues to grow and an operation that begins to lose its ability to maneuver.

How did hackers attack Signal and WhatsApp accounts?

According to the information disclosed, the groups would have taken advantage of legitimate functions of the applications, instead of breaking encryption or exploiting a classic system flaw. In Signal, the most delicate method was related to Linked Devices, the function that synchronizes messages between the mobile and the desktop, something that would have allowed them to read content and access the victims' contacts. Attempts to redirect users through manipulated invitation pages and social engineering messages seeking to obtain recovery keys or access codes were also detected.

That detail matters because it changes the conversation. We are not talking about an app that “failed” in its security promise, but rather about attackers who exploit user trust and normal usage flows to get their hands on the account. And these types of tactics are especially dangerous in encrypted messaging, because the weak point is not always in cryptography, but in human behavior.

Who was attacked by hackers?

The victims identified by authorities include US government officials, diplomatic personnel, defense and national security personnel, members of allied countries, journalists and organizations that support Ukraine. This profile makes it clear that the objective was not massive random theft, but rather access to conversations of high strategic value. Además, Google y otras entidades de ciberseguridad ya habían advertido sobre campañas similares atribuidas a actores rusos que usan apps de mensajería como una puerta de entrada a entornos sensibles.

In that context, the reward also functions as a political signal. Washington is saying that these types of campaigns will not be treated as isolated incidents, but as part of a broader threat against private communications and government targets. And at a time when digital security has become a matter of state, that message carries as much weight as the money offered.

Security measures that you can apply

For ordinary users, the case leaves a fairly clear lesson. Real security depends not only on the app, but also on how its functions are used, what permissions are accepted, and how easy it is to fall for a well-done impersonation. Checking linked devices, not sharing verification codes and being wary of unexpected messages is still basic, but now it is better understood why. Attackers don't always enter by breaking down doors; sometimes they just convince someone to open it for them.

For the tech ecosystem, furthermore, this announcement confirms that Signal and WhatsApp continue to be strategic assets in the global dispute over information. Messaging apps are no longer just tools for talking, they are also grounds for espionage, social engineering and covert operations. That is why this reward not only seeks to capture hackers, but also to put pressure on a form of attack that is increasingly refined.