Simply Cyber Newsletter #194

Crush Your Week Like a Cyber Pro with Simply Cyber!

AuthorAuthor

Gerald Auger & Chuck Sapp
August 17, 2026

Start your work week off at full speed with expert analysis and actionable intel from top cybersecurity news stories. Share with your End Users, Peers, and Executives to support weekly security awareness with the Simply Cyber Newsletter.

FOR END USERS

Russian military hackers pose as recruiters to target Ukrainian IT workers. Russia-linked Sandworm hackers are posing as recruiters to target Ukrainian IT workers. The attackers move candidates through realistic interviews, then direct them to install a fake corporate VPN built from legitimate WireGuard code that can execute malicious commands on their devices.

What you need to know: A recruiting process can look legitimate right up until the dangerous step. In this campaign, attackers used real job sites, ordinary screening questions, Telegram, Zoom interviews, and company lookalike email addresses before asking candidates to install software for a technical assessment.

Give your end users one moment to recognize: if a recruiter or interviewer asks them to download or install software as part of the hiring process, stop. Verify both the person and the request through the company’s official careers site or another contact method they found independently. A convincing interview, familiar company name, or legitimate job platform does not prove who is on the other side. If the software request cannot be independently confirmed, do not install it.

FOR PEERS

"City-Forum" data-theft attacks target Salesforce, ServiceNow portals. An ongoing campaign is extracting data exposed to anonymous users through Salesforce Experience Cloud and ServiceNow portals. Attackers are not exploiting a product vulnerability. They are using legitimate interfaces to find and retrieve data organizations have unintentionally made publicly accessible.

What you need to know: Speak with your peers about what your applications reveal before authentication.

City-Forum is a useful reminder that “no login required” is an access state, not a security boundary. The attackers are probing legitimate Salesforce and ServiceNow interfaces to identify objects, records, search results, and APIs available to guest users, then extracting what those permissions allow.

Instead of reviewing configuration alone, test the outside view. Ask your Salesforce and ServiceNow owners to examine the portals as an anonymous user and determine what can actually be enumerated, searched, or retrieved. Then compare that result with what the business intended to make public.

The portable question for the room: If we approached our public portals with no credentials and the goal of collecting data at scale, what would they give us?

FOR EXECUTIVES

Trump turns to private sector in offensive hacking operations memo. A new White House memorandum directs the creation of a program allowing vetted private companies to conduct cyber surveillance and offensive operations against foreign transnational criminal organizations under federal control. The program must operate within existing law, with implementation details still being developed.

What you need to know: Private cybersecurity firms have long supported investigations, intelligence gathering, disruption, and defense. This memorandum goes further by creating a path for vetted companies to conduct federally authorized cyber operations against foreign criminal organizations. That is not the same as giving companies permission to independently “hack back.” Participating firms would operate through government contracts, oversight, and approved targeting.

For executives, the immediate value is understanding that distinction before it appears in a future decision. Vendor capabilities, legal exposure, attribution, oversight, and even geopolitical risk may look different when a private company is performing work once associated primarily with government operators. The program is still being built, so the implementation details matter. For now, the finding is simple: the boundary between public and private offensive cyber capability is moving.

The takeaway is not to act on this yet, but to recognize the category when it appears. When it does, the executive question is whether the activity is operating under clear government authority, oversight, and legal boundaries.

Most AI content is fascinating. None of it is useful.

You’ve read the AI breakdowns. Watched the million AI explainers. Nodded along to the hot takes.

And then opened a blank doc and had no idea what to actually do.

The Shift is a newsletter built to help you in moments like this. Every tool covered works in the real world, and every prompt in the 1000+ library solves something you’ll actually hit. 

And right now, 3 subscribers win a free 1-year Claude Pro subscription. One click to enter.

DAILY CYBER THREAT BRIEF ON SIMPLY CYBER

JOIN US EVERY WEEKDAY MORNING 

Gerald Auger, Ph.D. livestreams the Daily Cyber Threat Brief on Simply Cyber every weekday at 8:00 AM EDT: https://cyberthreatbrief.simplycyber.io

Connect with cybersecurity enthusiasts and professionals alike who enjoy learning about the latest in cybernews together - jump into the live chat experience on YT!

IN CASE YOU MISSED IT: SOC INTERVIEW SERIES

Ever bombed a cybersecurity interview and never found out why? That ends here.
This playlist tackles one of the most frustrating parts of the job search: you don't get the offer, and you get zero feedback on what went wrong.

In each episode, Dr. Gerald Auger, PhD and senior cybersecurity practitioners who have actually hired for these roles present a real interview question with three authentic responses: junior, mid-career, and senior. Then you get the candid, constructive feedback that interviewers think but never say out loud.

  • Real interview questions

  • Three experience-level perspectives per question

  • Honest feedback from people who've made hiring decisions

  • Actionable takeaways you can use immediately

Stop leaving your next interview to chance - check out the series that’s helped other industry professionals ace the interview!

SC MEDIA GROUP WEEKLY EVENTS SCHEDULE

Learning and networking happening every day of the work week on Simply Cyber:

SC ACADEMY THE PLACE FOR CYBER CAREERS

At Simply Cyber Academy, we specialize in making GRC and Cybersecurity Careers a reality. Empower your career by learning real in-demand skills from cyber experts and the theory behind those skills with Simply Cyber Academy.

The popular GRC Analyst Master Class is a must for kickstarting your GRC Cybersecurity career. In addition, we have new courses covering various areas of focus in cyber available to help you advance in your career.

Check out the NEW FREE courses available in the academy!

Simply Cyber Academy Blog Highlight:

Check out the highlighted blog of the week on Simply Cyber Academy:  

LET’S CONNECT

Stay current on trending topics, tips, events and resources in cybersecurity, connect with Simply Cyber on socials for new content.

As always, please send me feedback. Which tip above is your favorite? What do you want more or less of? Other suggestions? Please let me know. Just send a DM on X with #actionableintel in the subject so I can find it.

Join us on the Daily Cyber Threat Brief happening every weekday morning at 8 AM Eastern on YouTube and LinkedIn.

Find more about what’s happening this week in the Simply Cyber community, below. Join us on the Daily Cyber Threat Brief happening every weekday morning at 8 AM Eastern on YouTube and LinkedIn.

Thank you and see you again next week, #TeamSC!

Gerry