NCSC warns of Russia-based messaging app targeting
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
NCSC and allies warn of growing Russian targeting of high-risk individuals via messaging apps like WhatsApp and Signal.
The NCSC has issued a coordinated warning alongside international partners of growing malicious activity targeting messaging applications. Russia-based threat actors are conducting account takeover and social engineering attacks against high-risk individuals—those whose roles provide access to or influence over sensitive information, including government officials and other high-value targets.
The advisory notes that attackers employ credential theft, account hijacking, and social engineering techniques via messaging platforms including WhatsApp, Messenger, and Signal. The NCSC has previously documented similar targeting campaigns by Chinese state-affiliated APT31, Russian FSB actor Star Blizzard, and Iran's IRGC against government officials' accounts.
Defenders and high-risk individuals are advised to enable multi-factor authentication, use strong unique passwords, verify unexpected contact through alternate channels before responding, avoid clicking links in unsolicited messages, and keep devices and applications updated. Government employees should follow official guidance on use of non-corporate communication channels.
Mentioned in this report
Detection guidance
Entra ID MFA Challenge Failed or Unanswered (Possible MFA Fatigue)
Entra ID sign-in failures at the MFA step (error 500121), which when repeated for one user indicate MFA prompt bombing after a password was compromised. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Entra ID MFA Challenge Failed or Unanswered (Possible MFA Fatigue)
description: Detects Entra ID sign-in events where the password was accepted but the
strong authentication (MFA) step failed, error code 500121 (user denied, did not
respond, or the push was rejected). A single event is common; alert or aggregate
in the SIEM when one user produces several of these in a short window (for example
5 or more in 10 minutes), which indicates MFA request bombing by an actor holding
valid credentials.
status: experimental
tags:
- attack.credential-access
- attack.t1621
logsource:
product: azure
service: signinlogs
detection:
selection:
ResultType: 500121
condition: selection
falsepositives:
- Users who mistype or miss legitimate MFA prompts, or who have a broken authenticator
app
- Travelling users with poor connectivity who time out on push notifications
level: medium
id: 3d2ca8f5-5aae-51ce-9167-dc30a4ff91c3
author: Vorant
references:
- https://www.ncsc.gov.uk/news/ncsc-warns-of-messaging-app-targeting
Entra ID Security Info or MFA Method Registered
New authentication method registered on an Entra ID account, which an attacker who hijacked the account may use to persist and bypass MFA. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Entra ID Security Info or MFA Method Registered
description: Detects registration or change of security info (MFA methods) on an Entra
ID account. After account takeover through phishing or credential theft, attackers
commonly add their own authenticator or phone method to keep access. Triage by correlating
with risky sign-ins, new locations, or activity shortly after a suspicious MFA prompt
sequence.
status: experimental
tags:
- attack.credential-access
- attack.persistence
- attack.t1556
logsource:
product: azure
service: auditlogs
detection:
selection:
OperationName:
- User registered security info
- Admin registered security info
- User changed default security info
condition: selection
falsepositives:
- Legitimate new-hire MFA enrolment or users replacing a lost or upgraded phone
- Helpdesk-driven MFA resets
level: low
id: 8d90d1a8-a1ab-5c52-8df9-0c65c0ebcece
author: Vorant
references:
- https://www.ncsc.gov.uk/news/ncsc-warns-of-messaging-app-targeting
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ncsc.gov.uk/news/ncsc-warns-of-messaging-app-targeting
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs