U.S. Puts $10 Million on Russian State Hackers Amid Surge in Messaging App Attacks

UNC5792 and UNC4221: A Growing Threat to Diplomatic and Defense Networks

Washington, June 29 — The United States announced a rewards program offering up to $10 million for information that leads to the identification or arrest of Russian state‑affiliated hacking groups UNC5792 and UNC4221. The groups have been probing U. S. government officials, senior military officers, and allied personnel, shifting their focus to popular messaging applications.

Officials say the move reflects a broader shift in cyber‑espionage tactics. Hackers are exploiting the encryption and ubiquity of apps such as Signal, Telegram and WhatsApp to bypass traditional network defenses. By embedding malicious code in seemingly harmless messages, they aim to harvest credentials and exfiltrate sensitive data. The Treasury Department’s Rewards for Justice program will manage the bounty, hoping to incentivize insiders or technical analysts to come forward.

Since early 2025, UNC5792 and UNC4221 have launched coordinated campaigns against the State Department, the Pentagon, and NATO allies. Their tools include custom malware that activates when a user opens a chat link, allowing attackers to install backdoors without triggering endpoint alerts. Cybersecurity firms estimate the groups have compromised dozens of accounts, though the full scope remains unclear. „These actors are adapting quickly, moving from email phishing to real‑time messaging exploits,” said Lisa Monroe, a senior analyst at the Center for Strategic Cyber Studies. The U. S. intelligence community attributes the groups to Russia’s Main Directorate (GRU), which reportedly uses them to gather political and military intelligence.

Can the $10 Million Reward Deter Russian Cyber Operations?

The bounty represents the largest single‑offer for a state‑linked hacker to date. Critics argue that financial incentives may have limited impact against nation‑state actors who operate under government protection. Yet proponents contend that the reward could pressure insiders to leak operational details or encourage defectors to provide actionable intelligence. „Even a single tip can disrupt a campaign and save lives,” noted Deputy Attorney General Karen Patel. The policy also signals a tougher stance, aiming to deter future exploitation of messaging platforms by making the cost of discovery higher for Russian intelligence services.

If the program yields credible leads, the United States could pursue indictments, sanctions, or coordinated cyber‑countermeasures. Analysts warn that Russia may respond with retaliatory cyber attacks, potentially targeting critical infrastructure. The evolving threat landscape underscores the need for continuous vigilance, robust authentication practices, and user education on suspicious links.

Frequently Asked Questions

What types of information qualify for the bounty? Any actionable intelligence that leads to the identification, apprehension, or prosecution of individuals linked to UNC5792 or UNC4221 qualifies, including technical artifacts, insider testimony, or communications.

How will the reward be paid? The Treasury Department will disburse the payment after a successful prosecution, subject to verification of the informant’s contribution and compliance with U. S. law.

Will this bounty affect other cyber‑crime reward programs? The offer may set a precedent for larger bounties against state‑backed actors, prompting other agencies to consider similar incentives for high‑profile threats.