Anton Prokopenkov

A new, highly adaptive component of the Russian Security Services (FSB) emerged with targeted campaigns against Ukrainian Signal and WhatsApp users across government and military sectors. Throughout 2026, this threat actor—tracked as UNC5792—has aggressively expanded its operations, executing mass-scale Signal account takeovers targeting high-ranking government officials, military leaders outside of Ukraine, and non-governmental organizations (NGOs). 

This talk unravels the lesser-known, hybrid mechanics of UNC5792 campaigns as they bridge the gap between remote cyber operations and tactical, physical proximity. We will trace their operational lifecycle: from harvesting intelligence from mobile devices seized on the battlefield, to compromising mobile messaging applications, orchestrating sophisticated credential-phishing campaigns, and deploying bespoke mobile spyware via close-access operations. Attendees will walk away with an in-depth threat profile of UNC5792's evolving toolkit and practical strategies to defend high-value mobile targets against hybrid espionage threats.