An Iranian threat actor exploits N-day vulnerabilities. CSC exposes subdomain hijacking vulnerabilities. More on the Discord Papers. An update on Russia’s NTC Vulkan. Joe Carrigan on the aftermath of a $98M online investment fraud. Our guest is Blake Sobczak from Synack , host of the podcast WE'RE IN! And threat actor nomenclature: a scorecard, and a Periodic Table no more.

For links to all of today's stories check out our CyberWire daily news briefing:
https://thecyberwire.com/newsletters/daily-briefing/12/74

Selected reading.
Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets (Microsoft Security)
An Iranian hacking group went on the offensive against U.S. targets, Microsoft says (Washington Post) 
New CSC Research Finds One in Five DNS Records are Susceptible to Subdomain Hijacking Due to Insufficient Cyber Hygiene | CSC (CSC)
DOD Assessing Document Disclosures and Implementing Mitigation Measures (U.S. Department of Defense)
After leak, Pentagon purges some users' access to classified programs, launches security review (Breaking Defense)
Why Did a 21-Year-Old Guardsman Have Access to State Secrets? (Vice)
U.S. officials have examined whether alleged doc leaker had foreign links (POLITICO) 
The Air Force Loves War Gamers Like Alleged Leaker Teixeira (Military.com) 
FBI Investigating Ex-Navy Noncommissioned Officer Linked to Pro-Russia Social-Media Account (Wall Street Journal)
Pentagon leak suggests Russia honing disinformation drive – report (the Guardian)
Dragos Analyzes Russian Programs Threatening Critical Civilian Infrastructure (Dragos) 
Microsoft shifts to a new threat actor naming taxonomy (Microsoft)