New Prinz Eugen ransomware prioritizes recent files for encryption
2026-06-21T01:23:42Z•a5cea8d60cdc5fd5d808ea7bcc686e4188379801951f530d617a41a0ed55a41f
active-exploitationai-agentscisacrypto-theftdata-breachedr-evasionextortionfortibleedfortinetidentity-and-governanceinformation-disclosuremalwaremfa-bypassnation-statenorth-koreaoauthprivacyransomwaresplunksupply-chainthird-party-riskusb-wormvulnerabilitywordpress
What happened
A set of active and emerging threats across multiple vectors: a new 'Prinz Eugen' ransomware family that prioritizes recently modified files and leaves no ransom note; Microsoft attributes a Mastra AI npm supply‑chain compromise (over 140 packages) to North Korean-linked Sapphire Sleet/BlueNoroff; Klue confirmed an OAuth token theft enabling the 'Icarus' extortion group to siphon Salesforce CRM data; an unauthenticated information‑disclosure bug in the Gravity SMTP WordPress plugin is being actively exploited on ~100,000 sites; a vendor breach exposed >3 million Texas driver’s license records;
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- bleepingcomputer
- Record identifier
- a5cea8d60cdc5fd5d808ea7bcc686e4188379801951f530d617a41a0ed55a41f
- Enrichment time
- 2026-06-21T01:23:42Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.