New Prinz Eugen ransomware prioritizes recent files for encryption
2026-06-20T19:23:30Z•3650a32ed6927c9f00b356cbd0b6dbbe3f48f6aff57e9438336f3d01652004ff
CISAEDR evasionFortiBleedFortinetGentlemen ransomwareGravity SMTPIcarusKlueMastra AIOAuthPrinz EugenSapphire SleetSplunk EnterpriseTexas Parks and WildlifeUSB wormWordPressactively-exploitedcredentials-leakcrypto-stealer','MFA bypass','AI agents identitydata-breachdriver-licenseinformation-disclosurenpmransomwaresupply-chain
What happened
Multiple high-impact security events reported: a new "Prinz Eugen" ransomware variant that prioritizes recently modified files and leaves no ransom note; Microsoft attributes a Mastra AI supply-chain compromise of 140+ npm packages to North Korea’s Sapphire Sleet (BlueNoroff); Klue suffered an OAuth/token compromise enabling the Icarus group to steal Salesforce data; an unauthenticated information-disclosure bug in the Gravity SMTP WordPress plugin is being actively exploited across ~100,000 sites; Texas Parks and Wildlife vendor breach exposed personal data for over 3 million driver’s license
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- 3650a32ed6927c9f00b356cbd0b6dbbe3f48f6aff57e9438336f3d01652004ff
- Enrichment time
- 2026-06-20T19:23:30Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.