Action in the cybercriminal underworld. Russia’s FSB and SVR are both active, and so are their hacktivist auxiliaries. NSA offers advice on configuring next-generation firewalls.

Open Bullet malware is seen in the wild. Threat actors exploit a Salesforce vulnerability for phishing. BlueCharlie (that’s Russia’s FSB) shakes up its infrastructure. Midnight Blizzard (and that’s Russia’s SVR) uses targeted social engineering. How NoName057(16) moved on to Spanish targets. Robert M. Lee from Dragos shares his reaction to the White House’s national cybersecurity strategy. Our guest Raj Ananthanpillai of Trua warns against oversharing with ChatGPT. And NSA releases guidance on hardening Cisco next-generation firewalls.

For links to all of today's stories check out our CyberWire daily news briefing:

https://thecyberwire.com/newsletters/daily-briefing/12/147

Selected reading.

No Honour Amongst Thieves: A New OpenBullet Malware Campaign (Kasada)

“PhishForce” — Vulnerability Uncovered in Salesforce’s Email Services Exploited for Phishing… (Medium)

Hackers exploited Salesforce zero-day in Facebook phishing attack (BleepingComputer)

Hackers exploit Salesforce email zero-day for Facebook phishing campaign (Computing) 

Russia-based hackers building new attack infrastructure to stay ahead of public reporting (Record) 

Midnight Blizzard conducts targeted social engineering over Microsoft Teams (Microsoft Security) 

Unraveling Russian Multi-Sector DDoS Attacks Across Spain (Radware)

Pro-Russian Hackers Claim Cyberattacks on Italian Banks (MarketWatch) 

NSA Releases Guide to Harden Cisco Next Generation Firewalls (National Security Agency/Central Security Service)

Cisco Firepower Hardening Guide (US National Security Agency)

Learn more about your ad choices. Visit megaphone.fm/adchoices