EU cyber defense unit warns of state-sponsored hacking of official messaging accounts

BRUSSELS — Foreign governments have been trying to hack the messaging accounts of high-ranking European Union officials, the bloc’s cyber defense unit said in an internal presentation obtained by POLITICO.

The presentation, given to officials from EU national governments in July, lists “account takeover targeting high-ranking officials” as one of the top threats facing the bloc this year.

The presentation is the first official acknowledgment that EU officials were targeted by cyberattacks through messaging apps, after several national cyber agencies flagged an ongoing campaign linked to Russian threat groups earlier this year. The presentation is also the first reported instance in which an EU authority formally links such attacks to a foreign government.

The officials were the targets of so-called “state-sponsored spearphishing,” the presentation said, a term for state-backed, targeted and bespoke campaigns to get specific people to click on dodgy links or open malicious attachments. Hackers used "social engineering techniques" to trick EU officials, crafting personalized messages that were more likely to get targets to take the bait.

Earlier this year, POLITICO first reported that the European Commission told some of its most senior officials to shut down a Signal group over hacking fears. It came at the same time as a series of warnings by national cyber authorities telling governments to move away from commercial messaging apps like WhatsApp and Signal for official business.

In March, at least five national cyber and intelligence agencies publicly warned about ongoing hacking campaigns on Signal and WhatsApp. Dutch intelligence services specifically pinned this on Russia, and Germany warned that hackers were targeting “high-ranking individuals in politics, the military, and diplomacy, as well as investigative journalists.”

The agencies warned then that hackers were posing as a fake Signal support chatbot to persuade users to share their codes, allowing them to take over an account to read incoming communications and group chats.

EU cybersecurity officials said in the presentation that the bloc's institutions had faced eight "significant incidents" so far this year. One key challenge, they flagged, is that the different EU institutions still use different technical cybersecurity solutions and lack a common solution to exchange sensitive and classified documents.

The European Commission declined to give details on internal security practices in response to POLITICO's questions on the presentation.

WhatsApp and Signal did not immediately respond to requests for comment.