Simply Cyber Newsletter #134

Crush Your Week Like a Cyber Pro with Simply Cyber!

AuthorAuthor

Gerald Auger & Chuck Sapp
June 16, 2025

Start your work week off at full speed with expert analysis and actionable intel from top cybersecurity news stories. Share with your End Users, Peers, and Executives to support weekly security awareness with the Simply Cyber Newsletter!

FOR END USERS

Off-brand IoT devices are still vulnerable to BadBox botnet, FBI says. The FBI warns that millions of off-brand smart devices, like streaming sticks and digital frames, are being sold with pre-installed malware. This allows criminals to secretly use your home network for their own activities, putting your personal data and online security at serious risk.

What you need to know: This is a great story to share with your end users - something they can think about in their personal networks: Building your dream smart home is exciting, but think of your gadgets as building materials. Using unknown, off-brand devices is like using faulty wiring; it might seem to work, but it creates hidden dangers. Honestly, identifying the malicious activity from these devices on your home network would be a challenge even for most cybersecurity experts.

This is why your best defense is proactive, not reactive. Take a moment to consider your electronic footprint. All those smart plugs that you bought for $15 that made holiday decorations so easy are a great example. If they're still plugged in just to run a simple lamp and other things, you could be elevating your risk for very little reward. Your home's security is only as strong as its weakest link, so unplugging what you don't truly need is a simple, powerful step.

When you do buy new technology, make well-informed choices from the start. Stick to trusted, well-known brands that have a reputation and support team that you can contact, and who may likely provide security updates for the devices they sell. In the near future, you'll also be able to look for products with the official U.S. Cyber Trust Mark that carries the intent of the device being in compliance with stronger security standards and support from the manufacturer.

FOR PEERS

PoC Code Escalates Roundcube Vuln Threat. A ten-year-old vulnerability in the popular Roundcube webmail client now has public exploit code available. The flaw allows an authenticated attacker to execute remote code, potentially leading to a full server compromise. Users are strongly advised to apply the latest security patches immediately.

What you need to know: Speak with your peers and ask if Roundcube is in your environment. It’s a perfect example of software that can be everywhere but formally owned by no one. Your key takeaway here is the risk of decentralized, often open-source, applications that get bundled into other services.

Establish a clear process for identifying and tracking these widely distributed tools. Every piece of software handling your data needs a designated owner responsible for monitoring for threats and applying patches. This prevents these utilities from becoming a major blind spot. Don't let something that seems like a minor convenience become your next major incident.

FOR EXECUTIVES

Whole Foods Supplier Hack Leaves Empty Shelves, Stalls Forklifts. A major grocery distributor recently suffered a cyberattack, forcing a network shutdown. The incident halted product deliveries to prominent stores, leading to empty shelves and significant operational disruption while the company worked to restore its systems and resume shipping nationwide.

What you need to know: Have conversations with your senior leaders around your risk tolerance for single points of failure within your supply chain. We often focus on our own defenses, but our operational resilience is only as strong as that of our most critical partners. It's a discussion about balancing cost savings against continuity.

That exclusive discount from a single-source supplier can look very attractive on a balance sheet. But what is the hidden cost? When a partner offers a deal for exclusivity, we are essentially betting our entire operational capability on their security posture. It’s a significant, often unstated, risk that can bring business to a halt.

Think of it as a form of insurance. Establishing and vetting relationships with secondary or even tertiary suppliers for critical goods and services isn't just a backup plan; it's a core component of a resilient business strategy. It ensures that when a disruption inevitably occurs in one corner of your ecosystem, you are not paralyzed by it. This is about guaranteeing your ability to deliver to your customers, no matter what happens to one of your vendors.

LET’S CONNECT

Stay current on trending topics, tips, events and resources in cybersecurity, connect with Simply Cyber on socials for new content.

As always, please send me feedback. Which tip above is your favorite? What do you want more or less of? Other suggestions? Please let me know. Just send a DM on X with #actionableintel in the subject so I can find it.

Join us on the Daily Cyber Threat Brief happening every weekday morning at 8 AM Eastern on YouTube and LinkedIn.

Find more about what’s happening this week in the Simply Cyber community, below. Join us on the Daily Cyber Threat Brief happening every weekday morning at 8 AM Eastern on YouTube and LinkedIn.

Thank you and see you again next week, #TeamSC!

Gerry

SIMPLY CYBER MEDIA GROUP PODCAST LINEUP

Simply Cyber Media Group presents our family of cybersecurity podcasts! We are on break until Q3, but check out the podcast episodes you may have missed in the meantime.

More podcasts coming in Q3 2025!

Visit youtube.com/@SimplyCyber/podcasts to explore all the podcasts!

SIMPLY CYBER FIRESIDES🔥

Thursday, June 19 at 4:30 PM EDT - Practical, Modern Purple Teaming

In this interactive live stream, Dr. Gerald Auger sits down with cybersecurity veteran Micheal Small to discover the exciting world of purple teaming. Mike brings a unique perspective, having worked across the cybersecurity spectrum in both offensive and defensive roles throughout his career.

Join us to learn:

  • Modern approaches to purple team operations

  • Bridging the gap between red and blue teams

  • Real-world implementation strategies

  • Current trends and challenges in purple teaming

  • Actionable insights for security teams of all sizes

This is YOUR chance to:

  • Ask questions directly to industry experts

  • Engage with the cybersecurity community

  • Get real-time answers to your purple teaming challenges

  • Network with fellow security professionals

Don't forget to bring your questions to the live chat. Our interactive format means your questions will be answered live on air!

SIMPLY CYBER CON 2025

When: Sunday, Nov. 2nd & Monday, Nov. 3rd

We’re excited to share Simply Cyber Con is back for the third year in a row!

Training Day is Sunday and the Main Conference is Monday at the Charleston Downtown Marriott.

Check out the conference website for details currently available at simplycybercon.org.

Registration for training and the conference is coming soon - hotel room block is available now.

Interested in sponsoring? Reach out to Gerry and let him know. It’s going to be the best one yet!

Stay tuned for updates! #simplycybercon

SC MEDIA GROUP WEEKLY EVENTS SCHEDULE

SC ACADEMY THE PLACE FOR CYBER CAREERS

At Simply Cyber Academy, we specialize in making GRC and Cybersecurity Careers a reality. Empower your career by learning real in-demand skills from cyber experts and the theory behind those skills with Simply Cyber Academy.

The popular GRC Analyst Master Class is a must for kickstarting your GRC Cybersecurity career. In addition, we have new courses covering various areas of focus in cyber available to help you advance in your career.

Check out the NEW FREE courses available in the academy and our new blog!

COURSES COMING SOON:

  • Hands-On Phishing with Tyler Ramsbey - Release Date: July 8th

  • OSINT for Pentesters with Mishaal Khan - Release Date: End of July