FBI links Signal phishing attacks to Russian intelligence services
2026-03-21T07:23:26Z•be3d46e7e03cdf5dc18515571166d2b600ece7ef950d43a295decc17dfb5845e
APT28AisuruCISACVE-2026-20131CVE-2026-21992CiscoGRUJackSkidKimWolfLazarus/BluenoroffMagentoMossadNorth KoreaOperation AliceOraclePolyShellRussian intelligenceSignalWhatsAppbotnet disruptiondata breachincident responsephishingtakedownunauthenticated RCE
What happened
Multiple high-impact security stories: the FBI warns Russian intelligence-linked actors are running widespread phishing campaigns targeting Signal and WhatsApp users, compromising thousands of accounts. Oracle released an out-of-band emergency patch for a critical unauthenticated RCE in Identity Manager/Web Services Manager (CVE-2026-21992). CISA ordered federal agencies to urgently patch a maximum-severity Cisco Secure FMC vulnerability (CVE-2026-20131) by March 22. A new ‘PolyShell’ vulnerability allows unauthenticated RCE and account takeover on Magento/Open Source and Adobe Commerce stores
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- be3d46e7e03cdf5dc18515571166d2b600ece7ef950d43a295decc17dfb5845e
- Enrichment time
- 2026-03-21T07:23:26Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.