Heise.De

Phishing Attacks via Signal Targeting German Officials and Journalists

First seen 7 Feb 2026, 04:28 UTC • Bleepingcomputer

+6 •75% similarity •34.1

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Germany's BfV and BSI have issued a warning regarding phishing attempts via the Signal messaging app. The attacks are believed to be conducted by state or state-controlled actors, targeting high-ranking officials in politics, military, and diplomacy, as well as investigative journalists in Germany and Europe.

ThreatCluster AI How this analysis works

Attack Flow

9 entities, 11 inferred relationships (STIX 2.1).

Threat Actor (2)

Sandworm
Unc5792

Technique (2)

Phishing
T1566 - Phishing

Campaign (1)

GhostPairing

Organization (1)

Signal

Affected Platform (3)

Telegram
Threema
WhatsApp

Relationships

Sandworm uses Phishing
Sandworm uses T1566 - Phishing
Unc5792 uses Phishing
Unc5792 uses T1566 - Phishing
GhostPairing attributed to Sandworm
GhostPairing attributed to Unc5792
Sandworm targets Signal
Unc5792 targets Signal
Sandworm related to Telegram
Sandworm related to Threema
Sandworm related to WhatsApp

Community

Browse all →

Tracked Entities in This Story

Sandworm Unc5792 GhostPairing Signal Telegram Threema WhatsApp

Phishing Attacks via Signal Targeting German Officials and Journalists

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story