🕵️ Mastra AI Attributed to North Korea, 🦠 Prinz Eugen Ransomware, ⚙️ Sinobi Technical Deep Dive, 📋 ENISA SBOM Report

Microsoft's attribution of the Mastra npm compromise to North Korea's Sapphire Sleet (BlueNoroff) is the day's defining story. What first looked like a supply-chain incident is now understood as a crypto-theft operation: the second-stage payload is a cross-platform stealer that checks for 166 cryptocurrency wallet extensions, with follow-on activity including a PowerShell backdoor previously tied to the group and a malicious Windows service granting SYSTEM. The Mastra attack attribution ties the June 17 compromise to the same campaign behind the April Axios npm attack, so affected developer machines should be treated as crypto-theft targets.

Prinz Eugen ransomware is a new hands-on-keyboard operation with an unusual profile: no RaaS, no ransom note on disk, extortion entirely out of band, RDP initial access, and a Go-based encryptor that prioritizes recently modified files. Researchers have identified at least five victims. Picus's analysis of Sinobi, a Lynx rebrand, shows how mature operations destroy shadow copies silently via DeviceIoControl instead of the noisy vssadmin command, defeating a common backup assumption.

ENISA's SBOM report concludes that generating software bills of materials is no longer the challenge; operationalizing them is, and the gap becomes a regulatory imperative as the Cyber Resilience Act moves toward December 2027 enforcement. FIRST now projects roughly 66,000 CVEs for 2026, driven in part by AI-assisted vulnerability discovery, raising the remediation floor for everyone.

Watchlist: audit developer machines for Mastra payloads and wallet-extension checks, verify backup assumptions against silent shadow-copy deletion, and start SBOM consumption workflows before the CRA deadline.