{
  "type": "bundle",
  "id": "bundle--5a86e8a3-947c-4765-890b-d046101d2f8e",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--caff07ed-ffad-5779-8b18-8d92dfadc2cc",
      "created": "2024-01-01T00:00:00Z",
      "modified": "2024-01-01T00:00:00Z",
      "name": "Marisec Intelligence",
      "identity_class": "organization",
      "description": "Clarity in a Complex Threat Landscape"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--4d84c292-ae30-5e27-9a59-6e5c72d575c1",
      "created": "2026-03-21T18:42:16.000Z",
      "modified": "2026-03-21T18:42:16.000Z",
      "created_by_ref": "identity--caff07ed-ffad-5779-8b18-8d92dfadc2cc",
      "name": "FBI Public Service Annoucement Involving Foreign Intelligence Service",
      "description": "The FBI released a public service annoucement about a phishing attack involving the Russian Intelligence Service. The attack targets commercial messaging applications such as WhatsApp and Signal.",
      "published": "2026-03-21T00:00:00.000Z",
      "report_types": [
        "threat-report"
      ],
      "labels": [],
      "object_refs": [
        "identity--caff07ed-ffad-5779-8b18-8d92dfadc2cc"
      ],
      "x_marisec_category": "Advisory",
      "x_marisec_sectors": [],
      "x_marisec_ai_disclosure": "partial",
      "x_marisec_vendor_agnostic": "agnostic",
      "x_marisec_author": "Richard Seguin",
      "x_marisec_slug": "fbi-public-service-annoucement-analysis-involving-foreign-intelligence-service",
      "x_marisec_content": "<p>The FBI and CISA released a joint public service announcement today (PSA I-032026-PSA) warning of an ongoing phishing campaign by Russian Intelligence Services targeting commercial messaging applications, specifically Signal and WhatsApp.</p><p>The actors impersonate commercial message application support accounts to trick targets into sharing verification codes or scanning malicious QR codes, enabling linked device abuse or full account takeover.&nbsp;</p><p>Given the current geopolitical climate, please consider reviewing the FBI article in the references section.&nbsp;Phishing&nbsp;may serve&nbsp;as&nbsp;an initial access vector in a larger compromise, especially on personal devices linked to corporate accounts.</p><p>A recent article in&nbsp;The Register reports that cybercrime has surged 245% since the start of the Iran war.&nbsp; The Iranian conflict has provided cover for&nbsp;nation-states, allowing them to carry out activities while global attention is focused on Operation Epic Fury.</p><p></p><p><strong>Recommendations</strong></p><ul><li><p>Review risky sign-in events flagged by Entra ID Identity Protection \u2014 focus on unfamiliar locations, atypical travel, and anomalous token activity</p></li></ul><ul><li><p>Watch for device code authentication flows, which Russian threat actors (Storm-2372) have used as a follow-on technique after social engineering</p></li><li><p>Pay attention to sign-ins from VPN exit nodes or anonymizing infrastructure, particularly for privileged accounts</p></li><li><p>For customers with BYOD policies, recommend auditing linked devices&nbsp;</p></li><li><p>If account compromise is confirmed or suspected, have the user immediately revoke all linked devices in the affected app and change their registration PIN.</p></li></ul><ul><li><p>Assess whether the compromised personal account was used to contact other individuals within the organization. If so, treat&nbsp;those contacts as potentially socially engineered and investigate their corporate accounts for signs of credential theft, rogue MFA registrations, or unusual sign-in activity.</p></li></ul><ul><li><p>Check whether the affected user has the same or similar passwords across their personal messaging accounts and corporate accounts. Credential reuse turns a personal app compromise into a corporate one.</p></li><li><p>Preserve Signal/WhatsApp message logs where possible before the user removes linked devices, as these may contain indicators of the phishing lure, attacker-controlled phone numbers, or QR code URLs useful for threat intelligence and IOC sharing.</p></li></ul><p><strong>References</strong></p><ul><li><p>Cybercrime has skyrocketed 245% since the start of the Iran war -<a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.theregister.com/2026/03/16/cybercrime_iran_war_245_percent_rise/\">https://www.theregister.com/2026/03/16/cybercrime_iran_war_245_percent_rise/</a></p></li><li><p>FBI Public Service Announcement (I-032026-PSA) \u2014 <a target=\"_blank\" rel=\"noopener noreferrer\" href=\"https://www.ic3.gov/PSA/2026/PSA260320\">https://www.ic3.gov/PSA/2026/PSA260320</a></p></li></ul><p></p><p></p>"
    }
  ]
}