Morning Review in IT Security — June 21, 2026

The cybersecurity landscape on June 21, 2026 reflects an escalating threat environment spanning nation-state operations, emerging ransomware variants, hardware vulnerabilities, and large-scale infrastructure compromises. Today's briefing covers critical incidents affecting software supply chains, enterprise infrastructure, and mobile device security.

Microsoft Links Mastra AI Supply Chain Attack to North Korean Hackers

Microsoft has attributed a recent Mastra AI supply chain attack that compromised more than 140 npm packages to the North Korean hacking group Sapphire Sleet, also known as BlueNoroff. The attack demonstrates the continued sophistication of state-sponsored actors in targeting development ecosystems to gain access to downstream users and organizations. Indicators of compromise include the malware families easy-day-js and PowerShell backdoor, which were distributed through the poisoned packages.

Source: Microsoft links Mastra AI supply chain attack to North Korean hackers

New Prinz Eugen Ransomware Prioritizes Recent Files for Encryption

A new ransomware operation named Prinz Eugen has emerged with a distinctive operational approach that prioritizes recently modified files for encryption while leaving no ransom note on infected systems. This targeting strategy suggests the threat actors aim to maximize damage to active business processes while potentially evading automated detection systems that may rely on ransom note signatures. The absence of traditional extortion messaging indicates a shift in ransomware tactics that may complicate victim response and attribution efforts.

Source: New Prinz Eugen ransomware prioritizes recent files for encryption

Unpatchable usbliter8 Exploit Breaks Apple A12 and A13 SecureROM Boot Chain

Security researchers at Paradigm Shift have published a working exploit called usbliter8 that achieves arbitrary code execution inside the SecureROM of Apple's A12 and A13 chips. Because this code is burned into silicon at manufacture, no software update can remediate the vulnerability. Devices affected by this flaw will retain this security weakness for their entire operational lifespan. While the exploit requires physical access and is not a remote attack vector, it represents a fundamental break in the secure boot chain for millions of devices still in active use.

Source: Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain

CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices

The U.S. Cybersecurity and Infrastructure Security Agency has issued an urgent warning to Fortinet customers regarding ongoing malicious activity targeting internet-accessible FortiGate appliances. The campaign, codenamed FortiBleed and attributed to Russian-speaking threat actors, has successfully compromised 86,644 FortiGate devices. The scale of this compromise represents a significant threat to enterprise network infrastructure and critical infrastructure operators relying on Fortinet security appliances.

Source: CISA Warns Fortinet Customers as FortiBleed Hits 86,644 FortiGate Devices

Today's threat landscape underscores the multifaceted nature of modern cybersecurity challenges, from supply chain poisoning by nation-states to emerging ransomware variants and unpatched hardware vulnerabilities affecting millions of devices globally. Organizations should prioritize inventory management, access controls, and incident response preparedness across all affected systems.