Loading signal...
Signal
Submitted
Mar 9, 2026, 12:05 UTC
Russian state hackers launched a global campaign targeting Signal and WhatsApp accounts of officials including in the Netherlands, using phishing and linked device exploits to access private messages and groups.
On March 9, 2026, Dutch defense confirmed that Russian state-sponsored hackers are conducting a cyber campaign globally aimed at compromising Signal and WhatsApp accounts of high-profile targets including government officials, military personnel, and journalists. The attackers primarily phish users by impersonating Signal support chatbots to obtain verification and PIN codes to take over individual accounts. They also exploit the linked devices feature to remotely access accounts without users noticing. Successful breaches allow hackers to read private conversations and group chats, acquiring potentially sensitive information. The Dutch MIVD and AIVD emphasize that no technical vulnerabilities in the messaging platforms are exploited; rather, the attackers misuse legitimate app features targeting individual users. Both agencies issued detailed cyber advice on how to recognize and respond to such account compromises, including guidance on verifying suspicious duplicate accounts in groups and removing them promptly. Users suspecting compromise are advised to coordinate with their organization's security teams to mitigate risk. This campaign reflects Russia's continued interest in targeting secure communication channels favored by governments despite end-to-end encryption protections.
Confidence: High
The article explicitly describes Russian state hackers conducting cyber intrusions against Signal and WhatsApp accounts of Dutch government officials and others, representing aggressor activity. It also details defensive preparations by Dutch intelligence services providing guidance and cyber advice to mitigate the threat, making it both an aggressor and defense signal.
Source URL
https://defensie.nl/actueel/nieuws/2026/03/09/rusland-voert-cybercampagne-uit-tegen-signal--en-whatsapp-accounts
Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "22ca4552-fbca-40de-8a0d-2866d01c7b82",
"url": "https://defensie.nl/actueel/nieuws/2026/03/09/rusland-voert-cybercampagne-uit-tegen-signal--en-whatsapp-accounts",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Netherlands",
"source_reliability": "A",
"info_credibility": "3",
"tags": [
"Russian state hacking",
"Signal",
"WhatsApp",
"offensive cyber operations",
"Dutch intelligence",
"MIVD",
"AIVD",
"Phishing",
"Linked devices",
"Cyber advisory",
"Information security"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [
"Netherlands"
],
"where_text": "Cyberspace",
"headline": "Russia conducts cyber campaign targeting Signal and WhatsApp accounts",
"description": "Russian state hackers are conducting a worldwide cyber campaign attempting to access numerous Signal and WhatsApp accounts belonging to dignitaries, military personnel, and officials. Dutch intelligence agencies MIVD and AIVD confirm Dutch government employees have been targeted and victimized. The hackers impersonate Signal support chatbots to phish verification and PIN codes and exploit the linked devices feature to access accounts remotely, enabling them to read messages and group chats, likely acquiring sensitive information. The campaign targets individual user accounts rather than technical vulnerabilities of messaging apps. MIVD director Vice Admiral Peter Reesink emphasized that despite end-to-end encryption, these apps are not channels for classified or sensitive information. AIVD director Simone Smit noted the threat focuses on individual accounts using legitimate app security features. The Dutch intelligence services issued cyber advice on detecting attacks and mitigating risks, including identifying compromised group members and managing access. Users are advised to report suspected compromises to their organization's information security department and take steps to verify and remove unauthorized accounts from chat groups.",
"summary_short": "Russian state hackers launched a global campaign targeting Signal and WhatsApp accounts of officials including in the Netherlands, using phishing and linked device exploits to access private messages and groups.",
"summary_extended": "On March 9, 2026, Dutch defense confirmed that Russian state-sponsored hackers are conducting a cyber campaign globally aimed at compromising Signal and WhatsApp accounts of high-profile targets including government officials, military personnel, and journalists. The attackers primarily phish users by impersonating Signal support chatbots to obtain verification and PIN codes to take over individual accounts. They also exploit the linked devices feature to remotely access accounts without users noticing. Successful breaches allow hackers to read private conversations and group chats, acquiring potentially sensitive information. The Dutch MIVD and AIVD emphasize that no technical vulnerabilities in the messaging platforms are exploited; rather, the attackers misuse legitimate app features targeting individual users. Both agencies issued detailed cyber advice on how to recognize and respond to such account compromises, including guidance on verifying suspicious duplicate accounts in groups and removing them promptly. Users suspecting compromise are advised to coordinate with their organization's security teams to mitigate risk. This campaign reflects Russia's continued interest in targeting secure communication channels favored by governments despite end-to-end encryption protections.",
"actor_primary": "Russian state hackers",
"target_primary": null,
"location_text": "Netherlands",
"location_region": null,
"location_coordinates_lat": null,
"location_coordinates_lon": null,
"location_precision": "Unknown",
"is_aggressor_signal": true,
"signal_type": "DEFENSE_PREP_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly describes Russian state hackers conducting cyber intrusions against Signal and WhatsApp accounts of Dutch government officials and others, representing aggressor activity. It also details defensive preparations by Dutch intelligence services providing guidance and cyber advice to mitigate the threat, making it both an aggressor and defense signal.",
"event_time_utc": "2026-03-09T11:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-03-09T12:05:00.137Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "unknown",
"time_precision_band": "exact",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
A
Info credibility
3
Event time
Mar 9, 2026, 11:00 UTC
Event time confidence
exact
Location
Netherlands
Primary actor
Russian state hackers
Country
Netherlands
Countries
Netherlands
Tags
Russian state hacking, Signal, WhatsApp, offensive cyber operations, Dutch intelligence, MIVD, AIVD, Phishing, Linked devices, Cyber advisory, Information security
Nodes
Node 2: 5th Column
Signal
Submitted
Mar 9, 2026, 12:05 UTC
Russian state hackers launched a global campaign targeting Signal and WhatsApp accounts of officials including in the Netherlands, using phishing and linked device exploits to access private messages and groups.
On March 9, 2026, Dutch defense confirmed that Russian state-sponsored hackers are conducting a cyber campaign globally aimed at compromising Signal and WhatsApp accounts of high-profile targets including government officials, military personnel, and journalists. The attackers primarily phish users by impersonating Signal support chatbots to obtain verification and PIN codes to take over individual accounts. They also exploit the linked devices feature to remotely access accounts without users noticing. Successful breaches allow hackers to read private conversations and group chats, acquiring potentially sensitive information. The Dutch MIVD and AIVD emphasize that no technical vulnerabilities in the messaging platforms are exploited; rather, the attackers misuse legitimate app features targeting individual users. Both agencies issued detailed cyber advice on how to recognize and respond to such account compromises, including guidance on verifying suspicious duplicate accounts in groups and removing them promptly. Users suspecting compromise are advised to coordinate with their organization's security teams to mitigate risk. This campaign reflects Russia's continued interest in targeting secure communication channels favored by governments despite end-to-end encryption protections.
Confidence: High
The article explicitly describes Russian state hackers conducting cyber intrusions against Signal and WhatsApp accounts of Dutch government officials and others, representing aggressor activity. It also details defensive preparations by Dutch intelligence services providing guidance and cyber advice to mitigate the threat, making it both an aggressor and defense signal.
Source URL
https://defensie.nl/actueel/nieuws/2026/03/09/rusland-voert-cybercampagne-uit-tegen-signal--en-whatsapp-accounts
Published as a Defense Preparations signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.
{
"id": "22ca4552-fbca-40de-8a0d-2866d01c7b82",
"url": "https://defensie.nl/actueel/nieuws/2026/03/09/rusland-voert-cybercampagne-uit-tegen-signal--en-whatsapp-accounts",
"source": "extension",
"status": "approved",
"category": "Cyber & Information Warfare",
"subcategory": "Cyber Attacks",
"incident_type": "Hacking, malware, ransomware",
"country": "Netherlands",
"source_reliability": "A",
"info_credibility": "3",
"tags": [
"Russian state hacking",
"Signal",
"WhatsApp",
"offensive cyber operations",
"Dutch intelligence",
"MIVD",
"AIVD",
"Phishing",
"Linked devices",
"Cyber advisory",
"Information security"
],
"nodes": [
"Node 2: 5th Column"
],
"countries": [
"Netherlands"
],
"where_text": "Cyberspace",
"headline": "Russia conducts cyber campaign targeting Signal and WhatsApp accounts",
"description": "Russian state hackers are conducting a worldwide cyber campaign attempting to access numerous Signal and WhatsApp accounts belonging to dignitaries, military personnel, and officials. Dutch intelligence agencies MIVD and AIVD confirm Dutch government employees have been targeted and victimized. The hackers impersonate Signal support chatbots to phish verification and PIN codes and exploit the linked devices feature to access accounts remotely, enabling them to read messages and group chats, likely acquiring sensitive information. The campaign targets individual user accounts rather than technical vulnerabilities of messaging apps. MIVD director Vice Admiral Peter Reesink emphasized that despite end-to-end encryption, these apps are not channels for classified or sensitive information. AIVD director Simone Smit noted the threat focuses on individual accounts using legitimate app security features. The Dutch intelligence services issued cyber advice on detecting attacks and mitigating risks, including identifying compromised group members and managing access. Users are advised to report suspected compromises to their organization's information security department and take steps to verify and remove unauthorized accounts from chat groups.",
"summary_short": "Russian state hackers launched a global campaign targeting Signal and WhatsApp accounts of officials including in the Netherlands, using phishing and linked device exploits to access private messages and groups.",
"summary_extended": "On March 9, 2026, Dutch defense confirmed that Russian state-sponsored hackers are conducting a cyber campaign globally aimed at compromising Signal and WhatsApp accounts of high-profile targets including government officials, military personnel, and journalists. The attackers primarily phish users by impersonating Signal support chatbots to obtain verification and PIN codes to take over individual accounts. They also exploit the linked devices feature to remotely access accounts without users noticing. Successful breaches allow hackers to read private conversations and group chats, acquiring potentially sensitive information. The Dutch MIVD and AIVD emphasize that no technical vulnerabilities in the messaging platforms are exploited; rather, the attackers misuse legitimate app features targeting individual users. Both agencies issued detailed cyber advice on how to recognize and respond to such account compromises, including guidance on verifying suspicious duplicate accounts in groups and removing them promptly. Users suspecting compromise are advised to coordinate with their organization's security teams to mitigate risk. This campaign reflects Russia's continued interest in targeting secure communication channels favored by governments despite end-to-end encryption protections.",
"actor_primary": "Russian state hackers",
"target_primary": null,
"location_text": "Netherlands",
"location_region": null,
"location_coordinates_lat": null,
"location_coordinates_lon": null,
"location_precision": "Unknown",
"is_aggressor_signal": true,
"signal_type": "DEFENSE_PREP_SIGNAL",
"is_hybrid_war_signal": true,
"classification_complete": true,
"hybrid_signal_complete": true,
"classification_confidence": "High",
"classification_rationale": "The article explicitly describes Russian state hackers conducting cyber intrusions against Signal and WhatsApp accounts of Dutch government officials and others, representing aggressor activity. It also details defensive preparations by Dutch intelligence services providing guidance and cyber advice to mitigate the threat, making it both an aggressor and defense signal.",
"event_time_utc": "2026-03-09T11:00:00.000Z",
"end_time_utc": null,
"event_time_confidence": "exact",
"created_at": "2026-03-09T12:05:00.137Z",
"updated_at": "2026-11-04T08:35:32.139Z",
"reliability_band": "strong",
"location_precision_band": "unknown",
"time_precision_band": "exact",
"severity_band": "moderate",
"attribution_confidence_band": "high",
"attribution_basis": "independent_sources"
}Source reliability
A
Info credibility
3
Event time
Mar 9, 2026, 11:00 UTC
Event time confidence
exact
Location
Netherlands
Primary actor
Russian state hackers
Country
Netherlands
Countries
Netherlands
Tags
Russian state hacking, Signal, WhatsApp, offensive cyber operations, Dutch intelligence, MIVD, AIVD, Phishing, Linked devices, Cyber advisory, Information security
Nodes
Node 2: 5th Column