The Ransomware That Skips the Ransom Note

A new ransomware operation called Prinz Eugen is hitting victims without ever explaining why. According to researchers at ThreatDown (Malwarebytes' enterprise security arm), the group leaves no ransom note at all — victims discover the attack only after their most recently modified files are already encrypted.

The group works hands-on-keyboard rather than relying on automated tools. Initial access starts with stolen RDP (Remote Desktop Protocol — remote login access to a computer) credentials. Once inside, an operator manually downloads and runs the main payload, a file named servertool.exe, rather than letting malware spread on its own. In one investigated case, the attackers installed RemotePC, a legitimate remote-access tool, and created a hidden backdoor administrator account to maintain access even if the original entry point closed.

Unlike most modern ransomware crews, Prinz Eugen does not run as a ransomware-as-a-service (RaaS — a model where developers rent their ransomware out to other criminals) operation. There is no affiliate program, no recruitment drive, just a small group working directly.

The file-prioritisation detail matters: encrypting your newest files first means the most current, most valuable work is gone before older backups even register as a target.

What to do: Disable RDP entirely if you do not need remote access, or lock it behind multi-factor authentication if you do. Treat any RemotePC installation you did not set up yourself as a compromise indicator, and audit your administrator account list for anything unfamiliar.

The Mastra AI supply chain attack is worth examining as an emerging threat pattern, not just a one-off breach. Sapphire Sleet did not hack developers directly. Instead, according to Bleeping Computer, they compromised a single package maintainer account and used it to push malicious code into 140+ packages that developers were already trusting and installing automatically.

AI development frameworks are a particularly attractive target here. Developers building AI tools frequently install large numbers of third-party packages, often in automated pipelines that run without human review at each step. The attackers exploited exactly that trust. Once inside a developer's machine, they went specifically for cryptocurrency wallets and API keys — a financially motivated choice consistent with Sapphire Sleet's broader campaign history.

What to do: If your team uses npm packages in AI or any other development work, consider enabling package integrity checks and auditing install logs for unexpected post-install script execution.

No notable new vulnerability disclosed in the last 24 hours.

A recently disclosed flaw in Gravity SMTP, a popular WordPress email plugin, exposes a site's full system report — including API keys and email service credentials — to anyone who knows the right URL. Wordfence has logged over 17 million exploit attempts against it, which means attackers are scanning broadly, not hand-picking targets.

If you run a WordPress site, you do not need to wait for the next disclosed plugin flaw to check your exposure. Free tools like Wordfence can scan your installed plugins for endpoints that return data without requiring a login — exactly the pattern behind this flaw and many others like it.

What to do: Run a Wordfence scan on your site today, even if you do not use Gravity SMTP. If you do use it, update to 2.1.5 immediately and rotate every API key and OAuth token tied to your email integrations — treat them as already exposed.

No major compliance updates today.