⚡️Interesting Cybersecurity News and APT Research of the Week ⚡️ 📊 Attacks on small and medium-sized businesses increased by 5% last year. Attackers' favourite tactic is disguising malware as Excel files. securelist.com/smb-threat-re… ⚡️ Warn your developers—new phishing attacks are being sent through GitHub infrastructure, masquerading as job offers. While a job offer in a commit comment sounds odd, some users fall for it and lose their GitHub accounts (and sometimes their repositories). kaspersky.com/blog/github-ph… 🤯 The Chamelgang group, focused on espionage, uses CatB ransomware to cover their tracks and mask the operation's objectives. sentinelone.com/labs/chamelg… Analysis of the new backdoor HappyDoor, used by APT Kimsuky. asec.ahnlab.com/ko/67128/ 👮♂️ Some hackers focused on trojan and infostealer distribution are overly greedy—they install a dozen different malware on affected systems: MysticStealer, Smokeloader, Redline, and more. The actor, named Unfurling Hemlock, is geographically indiscriminate, with victims in the USA, Russia, Germany, Turkey, India, and other countries. outpost24.com/blog/unfurling… 🔑 TeamViewer was hacked, the investigation has been ongoing since Thursday, and on Sunday it was confirmed that only the office network was compromised and attackers stole encrypted employee passwords for corporate accounts. Even if the scope of the compromise is final, a sequel seems likely. teamviewer.com/en/resources/… GitLab has patched 14 vulnerabilities in its products, including critical ones. Update now. about.gitlab.com/releases/20… 🚀 Supply chain attack on the web: new owners of the popular library and site Polyfill JS injected malicious scripts into all sites using this library, loading from cdn.polyfill.io, which is used by 100,000 sites. Cloudflare and Google have blocked the site, but the attackers are persistent. sansec.io/research/polyfill-… Google Chrome is gradually ceasing to trust certificates issued by Entrust. security.googleblog.com/2024… 📱 Analysis of the Android RAT called SpyMax, targeting Telegram users. labs.k7computing.com/index.p… Another piece of Android malware, Snowblind, is interesting not just for its malicious functionality but for its innovative use of seccomp to bypass integrity checks in the infected app. Welcome to a world where even sandboxes can be malicious tools. ☠️ promon.co/app-threat-reports… #digest #APT #CybersecurityNews #cybersecurity