Signal Backup Recovery Key Flaw Exploited by Russian Spies Gets Formal Cryptographic Fix Today

Hand over your Signal Backup Recovery Key once — to a fake support message, a phishing link, or a convincing impersonator — and an attacker can read your entire message archive going back to the first day you turned on backups. That specific attack has now compromised thousands of accounts globally, and Russia's FSB and GRU were doing it at scale months before any formal fix existed, according to the FBI and CISA advisory I-062626-PSA . As of today, a formal cryptographic proposal finally addresses why that single credential is so catastrophically powerful — and what it would take to stop it from being so.

Shaurya Pratap Singh, a researcher at the Indian Institute of Science (IISc) Bangalore, posted a preprint today at the IACR Cryptology ePrint Archive proposing STEBR — the Secure Timed-Erasure Backup Ratchet — a three-layer hardening architecture for Signal's backup key management system. The proposal arrives exactly one month after the FBI and the Cybersecurity and Infrastructure Security Agency formally named the two Russian intelligence clusters responsible for a months-long campaign that stole backup keys rather than breaking Signal's encryption.

Signal's Double Ratchet — the cryptographic protocol also used by WhatsApp, Google's RCS messaging, and Messenger to protect the messages of billions of users combined — advances the session key with every message sent and received. Old keys are deleted immediately. This property, called forward secrecy, means that an attacker who steals your phone today cannot read your conversations from last month, because those message keys no longer exist anywhere. The protocol also self-heals after a breach: once you receive a new message, a fresh Diffie-Hellman exchange locks the attacker out again — a property called post-compromise security.

Signal's encrypted backup system works on entirely different principles. When a user enables backups, Signal generates a 64-character recovery key on their device and never shares it with Signal's servers. That key stays constant unless the user manually rotates it. There is no ratchet advancing it forward. There is no self-healing after a compromise. There is no bounded exposure window. The STEBR preprint proves this formally: the baseline backup design fails even a minimal forward-secrecy-style security notion, meaning a single key disclosure at any point in time exposes the entire backup history, with no cryptographic recovery path.

Signal introduced secure cloud backups in September 2025 , with the feature reaching all users in February 2026. Within months, Russian intelligence had identified the static backup key as the most efficient way to access archived conversations at scale — without touching the cryptography at all.

The FBI and CISA advisory published June 26 describes the mechanics in detail. Operatives from UNC5792, linked to Russia's Federal Security Service (FSB) Border Guards division, and UNC4221, linked to Russia's military intelligence service (GRU), sent messages impersonating Signal's automated support accounts, according to a joint SBU and FBI disclosure . Targets — government officials, military personnel, journalists, political figures, and Ukraine-based individuals of intelligence interest — received urgent-sounding warnings account problems or security updates that required them to navigate to Settings, enable backups, and paste their Recovery Key into the conversation. Many did.

Handing over the key once allows an attacker to restore the account's backup archive and read its full message history — including every private conversation and group thread ever stored. Worse, the key does not expire when a victim buys a new phone or creates a new Signal account on the same number: the stolen key continues to work against future backups until the user explicitly generates a new one in Settings.

The STEBR proposal does not modify the Double Ratchet, Signal's PQXDH post-quantum handshake, or the wire format of any message envelope. It attaches entirely to the backup-key management layer above those existing protocol primitives.

The first layer is a self-erasing hashchain ratchet. Rather than using a single static backup key for the entire message archive, STEBR advances the backup key on a scheduled cadence — daily, weekly, or at whatever epoch interval is configured — and cryptographically destroys old epoch keys after they are no longer needed. If an attacker obtains the current epoch key through social engineering, the damage is bounded: they gain access only to the messages backed up during the current epoch window, not years of prior history. The security here rests on the pseudorandom function (PRF) security of the key-derivation function — a standard cryptographic assumption — which the preprint formally proves limits the blast radius of any single key compromise.

The second layer addresses what the paper identifies as the "single credential, single interaction" problem. Currently, one successful phishing message is enough to capture a usable key. STEBR distributes the current epoch key among multiple independently held devices or trusted contacts using Shamir secret sharing , a technique invented by cryptographer Adi Shamir in 1979. Under a (t, n) configuration — for example, requiring any three of five guardians — no single interaction yields anything usable. An attacker must compromise t separate guardians before any backup data is at risk. The security guarantee here is information-theoretic: even a computationally unbounded attacker learns nothing the epoch key from fewer than t shares. The impersonation playbook that has worked against thousands of Signal users fails completely against this structure — because stealing one is the same as stealing nothing.

The third layer adds time-bounded key expiration. Epoch keys are cryptographically committed to a validity window. After that window closes, the keys cannot decrypt backup data even if they are later exposed. The formal security argument for this layer rests on the IND-CPA security of the backup authenticated encryption scheme (AEAD) — the standard symmetric confidentiality notion, as the preprint details .

The largest implication of the STEBR paper extends beyond Signal. The Double Ratchet, PQXDH, and every component of Signal's transport-layer cryptography have been subjected to decades of formal analysis; a paper published at IEEE Security and Privacy 2026 by researchers at the University of Oxford and LORIA/Inria found three previously unknown forward-secrecy attacks in the Double Ratchet — two in the main implementation, one in the specification — all since reported and patched by Signal's developers. The backup layer has received comparatively little formal attention, and Signal is not alone in using a static credential to protect archived messages: WhatsApp's optional end-to-end encrypted backups are protected by a user-chosen password or a 64-digit encryption key — the same structural design.

An app that uses Signal-grade encryption for message transport does not automatically protect its backups with equivalent security. The backup layer is a separate system with a separate threat model, and STEBR is the first formal proposal to apply ratchet-style forward secrecy thinking to it.

The preprint is candid what it has not resolved. Deploying threshold secret sharing to non-technical users presents serious usability challenges that the paper acknowledges but does not fully address. A (3, 5) guardian scheme requires users to identify and coordinate with five trusted contacts who can each store a single on their devices — a setup flow that may be straightforward for security professionals and considerably harder for the general public. If guardians are unavailable when a user needs to restore a backup, the restoration fails even if the user's own device is healthy.

Cross-epoch backup restoration also adds complexity: accessing a message from a prior epoch requires retaining the epoch key that was valid at that time. STEBR's architecture requires careful management of key epochs to support queries across historical backup windows.

As a preprint, STEBR has not yet undergone peer review, and Signal's development team has not publicly commented on the proposal. Signal has historically been responsive to academic findings — PQXDH was integrated after years of academic pressure on X3DH's long-term key exposure in harvest-now-decrypt-later threat models; the Double Ratchet patches followed responsible disclosure from the 2026 S&P analysis . Whether STEBR, or something incorporating its core ideas, finds a path into production remains an open question.

STEBR is a proposal, not a patch. For Signal users today — especially those with elevated threat profiles — the FBI's mitigation guidance is the most immediately available tool.

Generating a new Backup Recovery Key in Signal Settings (Settings → Backups → View recovery key → Generate new key) invalidates the old credential for all future backup downloads. Any backup an attacker already pulled before the rotation remains accessible to them, but no new downloads will succeed with the old key.

Any in-app message claiming to be from Signal support requesting a recovery key, verification code, or PIN is fraudulent. Signal's policy is unambiguous: the company never contacts users inside the app, and its servers never hold a copy of any recovery key.

Reviewing and removing any linked devices not personally recognized (Settings → Linked Devices) limits the alternate access vector — linked-device hijacking — that Russian intelligence used in the operation's earlier phases before pivoting to backup key theft.

The technical insight STEBR formalizes at the cryptographic level is one the phishing campaign already demonstrated in practice: forward secrecy is only as strong as the weakest credential in the system. For years, the backup key has been that weakest credential. Today is the first time anyone has published a formal proof of exactly how weak it is — and a concrete proposal for making it stronger.

No. The FBI and CISA advisory explicitly confirmed that neither UNC5792 nor UNC4221 broke Signal's encryption or compromised the application itself. The Double Ratchet and PQXDH handshake that protect messages in transit remain secure. The attack vector is entirely social engineering: operatives trick users into handing over a backup credential, which then grants access to already-encrypted archives through a completely legitimate feature. The cryptography works. The attack targets the person holding the key.

Generate a new Backup Recovery Key immediately in Signal Settings (Settings → Backups → View recovery key → Generate new key). The new key invalidates the old one for any future backup restoration attempts, cutting off any attacker who obtained the key. Any backup already downloaded before the rotation is unrecoverable — the advisory is clear on that — but this step prevents further damage. Remove any linked devices in Settings → Linked Devices that you do not recognize. Treat any in-app message from any account claiming to be Signal Support as an attack: Signal never reaches out to users inside the app.

The Double Ratchet encryption that protects messages in transit on WhatsApp, Google RCS, and Messenger is not affected by this vulnerability. However, the structural issue STEBR addresses — a static backup credential protecting an otherwise-forward-secret archive — exists in any E2E-encrypted platform that offers optional cloud backup protected by a user-held key or password. WhatsApp's optional end-to-end encrypted backups use a similar design. "This app uses Signal encryption" describes the transport layer only; it says nothing whether the backup layer has equivalent protections. STEBR's paper is the first to formalize that distinction and propose a solution, but it addresses Signal's backup system specifically.

STEBR (Secure Timed-Erasure Backup Ratchet) is a formal academic proposal published today as a preprint at the IACR Cryptology ePrint Archive by Shaurya Pratap Singh of IISc Bangalore. As a preprint, it has not yet undergone peer review, and Signal's developers have not commented on it. Signal has historically adopted academic recommendations — PQXDH and the 2026 Double Ratchet patches both originated in academic papers — but deployment timelines for proposals at this stage typically range from months to years. There is no guarantee Signal will adopt STEBR's specific design. For now, the best available protection is rotating your backup recovery key and treating any in-app support message as fraudulent.