According to the Security Service of Ukraine (SBU), the purpose of the breaches was to gain access to sensitive military, political and economic information exchanged by users, as well as to steal personal data.
The SBU said Russian operatives most often use text messages purportedly sent by “support teams” to trick users into revealing account passwords. Such messages are disguised as notifications from official bots and are typically sent in the morning, when users may be more vulnerable due to their physical and emotional state.
The agency warned that Russian intelligence services and affiliated hackers target not only organizations, officials and public figures, but also the personal accounts of ordinary Ukrainians.
The SBU urged users to follow basic cybersecurity practices, including:
Regularly reviewing active sessions in messaging apps and terminating any unfamiliar connections;
Enabling two-factor authentication and using strong alphanumeric PIN codes;
Never sharing verification codes, PINs, passwords or account recovery keys;
Avoiding suspicious links, even if they appear to come from someone you know, as their account may have been compromised;
Not opening files received from unknown or suspicious chats, especially if asked to do so from a computer;
Avoiding QR codes sent by unknown bots or users, as they can be used to connect an attacker’s device to your account.