Brief #92: Russian APTs Target Signal, GitHub Security Issues, Importance of Career Growth

Happy Sunday!

Hope you're having a great weekend. There's quite a bit happening in our space this week that I think you'll find valuable:

Russian threat actors found a clever way to intercept Signal messages through device-linking - definitely worth checking if your team uses Signal for sensitive communications.
NVIDIA shared write-up about Agent Morpheus that analyzes CVEs in seconds instead of the usual days-long process. If you're dealing with vulnerability management, this could save you tons of time.
Interesting data from IANS Research shows that even with great salaries, security pros are looking elsewhere due to limited growth paths. Might be worth reviewing your team's career development plans if you're in a leadership role.

Let's dive into the details below.

Your feedback shapes Mandos Brief and I'd love to hear your thoughts about the content I share.

INDUSTRY NEWS

Multiple Russian state threat actors are exploiting Signal's "linked devices" feature by tricking users into scanning malicious QR codes that connect victim accounts to attacker-controlled devices, enabling real-time message interception.
Threat actors including APT44 (Sandworm) and UNC5792 use various methods including fake military apps, group invites, and security alerts to deliver malicious QR codes, while also deploying tools to steal Signal databases directly from compromised devices.
The targeting extends beyond Signal to other messaging apps like WhatsApp and Telegram, with attacks combining both remote phishing operations and close-access physical device exploitation when possible.

TA2726 operates as a TDS provider, facilitating traffic distribution for multiple threat actors including TA569, primarily targeting North America with SocGholish, while redirecting other regions to TA2727's malware campaigns.
TA2727 delivers multiple payloads based on geography and device type, including Lumma Stealer (Windows), Marcher (Android), and a newly discovered FrigidStealer targeting MacOS systems through fake browser update lures.
The threat landscape has become increasingly complex with multiple actors using similar web inject techniques, making attribution challenging, with infrastructure patterns showing both actors leveraging compromised legitimate websites to distribute their malware.