Google researchers say multiple Russian state threat groups have conducted remote phishing operations to target and compromise Signal accounts.

The malware-laced files include draft versions of diplomatic statements, correspondence letters, internal administrative notes and other documents.

The hackers were working with a unit in the Russian Main Intelligence Directorate, according to the DOJ.

The Russian hacktivists have been linked to the state-backed Sandworm group.

Amin Timovich Stigal is alleged to have participated in attacks dubbed “WhisperGate” ahead of Russia’s 2022 invasion of Ukraine.

Researchers from the Google-owned firm conclude that Sandworm personas are linked to several recent attacks on critical infrastructure. 

U.S. authorities disrupted the infrastructure used by a notorious Russian hacking group linked to the country's military intelligence agency.

Ukrainian officials say Russian hackers targeted counter-intelligence and law enforcement data during the first half of this year.

Dubbed "Cadet Blizzard," the hacking group carried out operations targeting Ukrainian infrastructure in the run-up to the Russian invasion.

Researches believe the destructive malware is the work of Sandworm, a Russian military unit suspected in a series of Ukrainian cyberattacks.