Cybersecurity — June 9, 2025

### Spotlight on Significant Vulnerabilities and Emerging Threats #### New Mirai Botnet Exploiting DVR Vulnerabilities A newly identified variant of the Mirai botnet is utilizing a command injection vulnerability (CVE-2024-3721) within TBK DVR-4104 and DVR-4216 devices to create an expansive botnet network. This exploitation could allow threat actors to hijack DVRs, raising concerns about the escalating threat landscape involving IoT devices. Ensuring these devices are updated with the latest firmware and securing network configurations are critical steps in mitigating potential risks. [Read more](https://securityaffairs.com/178779/malware/new-mirai-botnet-targets-tbk-dvrs-by-exploiting-cve-2024-3721.html) #### Google Fixes Chrome Zero-Day Exploit Google has issued patches for a critical zero-day vulnerability in Chrome (CVE-2025-5419) that was actively being exploited in the wild. This update underscores the persistent threat posed by zero-day exploits, necessitating immediate action by users to update their browsers to the latest version to avoid potential security breaches. [Read more](https://www.helpnetsecurity.com/2025/06/08/week-in-review-google-fixes-exploited-chrome-zero-day-patch-tuesday-forecast/) #### Vendor Email Compromise Threats Surge Over the past year, there have been attempts to steal over $300 million through vendor email compromise (VEC) attacks, with large organizations being the most targeted. The report highlights the increasing sophistication of these attacks, emphasizing the need for improved email security solutions and employee training to prevent successful intrusions. [Read more](https://www.helpnetsecurity.com/2025/06/09/vendor-email-compromise-attacks-vec/) ### Industry Updates and Policy Changes #### Trump Cybersecurity Executive Order In an effort to amend previous executive orders, President Trump has signed a new cybersecurity executive order focusing on digital identity and sanctions policies. The order seeks to enhance national cybersecurity measures but has implications for how businesses manage digital identities and compliance with international policies. [Read more](https://www.securityweek.com/trump-cybersecurity-executive-order-targets-digital-identity-sanctions-policies/) #### US Infrastructure Vulnerabilities Highlighted A former NSA advisor has warned about the vulnerability of US critical infrastructure to potential cyberattacks, citing concerns over inadequate resilience to sophisticated threats. This opinion highlights the urgent need for strengthening cybersecurity frameworks across vital sectors. [Read more](https://go.theregister.com/feed/www.theregister.com/2025/06/08/exnsc_official_not_sure_us/) ### You May Also Be Interested In... - **Enterprise SIEMs Miss 79% of MITRE ATT&CK Techniques**: A study shows gaps in SIEM coverage of attack techniques, urging companies to review their security postures. [Read more](https://www.helpnetsecurity.com/2025/06/09/siem-detection-coverage/) - **Librarian Ghouls APT Uses RAR Archives and BAT Scripts**: Details on attacks targeting Russian entities, emphasizing the ongoing threat from APT operations. [Read more](https://securelist.com/librarian-ghouls-apt-wakes-up-computers-to-steal-data-and-mine-crypto/116536/) - **Supply Chain Attack on NPM Gluestack Packages**: An attack compromises critical software components, affecting thousands of developers globally. [Read more](https://securityaffairs.com/178772/malware/over-950k-weekly-downloads-at-risk-in-ongoing-supply-chain-attack-on-gluestack-packages.html) Stay informed, stay secure.

A clearer view of today.

Your briefing

A clearer view of today.

Your briefing

Make room for a smarter morning.