WAVESIGN
WAVESIGN is a Windows batch script used to decrypt and exfiltrate data from Signal Desktop. Google Threat Intelligence Group (GTIG) reported its use by the Russian threat actor APT44, also known as Sandworm and FROZENBARENTS, which multiple governments attribute to GRU Unit 74455. The tooling has been described in the context of Russian operations supporting military objectives in Ukraine, including efforts to extract data from secure messaging applications such as Signal and Telegram from battlefield or captured devices. The content specifically and repeatedly identifies WAVESIGN as responsible for decrypting and exfiltrating Signal Desktop data on Windows systems; one source also broadly describes it as used to steal Signal and Telegram data from battlefield devices. The malware is associated with targeting Ukrainian military communications and defense-related entities. No specific indicators of compromise are provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
GTIG has also identified APT44 leveraging WAVESIGN, a Windows Batch script responsible for decrypting and exfiltrating data from Signal Desktop.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Windows batch-script tool used to decrypt and exfiltrate Signal and Telegram data from battlefield devices.
Tool used by APT44 in operations targeting Signal/Telegram data; used to steal information from Windows and Android devices (per the cited summary).
Windows batch script used to decrypt and exfiltrate data from Signal Desktop after likely physical access to devices.
Windows Batch script used by Sandworm/APT44 in activity targeting Signal; specific capabilities are not detailed in the provided content.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.