Daily Threat Briefing — Jun 22, 2026

📰 Cybersecurity News Headlines

Top stories from leading cybersecurity publications as of June 22, 2026.

1. AryStinger botnet infected thousands of D-Link routers worldwide
   — Bleeping Computer
   
   A previously undocumented malware botnet named AryStinger has compromised more than 4,000 outdated routers to turn them into proxies for mal…
2. New Prinz Eugen ransomware prioritizes recent files for encryption
   — Bleeping Computer
   
   A new ransomware operation named 'Prinz Eugen' prioritizes recently modified files for encryption and leaves no ransom note on the system. […
3. Microsoft links Mastra AI supply chain attack to North Korean hackers
   — Bleeping Computer
   
   Microsoft has attributed a recent Mastra AI supply chain attack that compromised more than 140 npm packages to the North Korean hacking grou…
4. Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
   — The Hacker News
   
   Threat actors are exploiting a recently patched security flaw impacting Gravity SMTP, a WordPress plugin that's installed on about 100,000 s…
5. Threat Brief: Mitigating Large-Scale Credential Attacks
   — Unit 42
   
   We provide guidance for preparing for and mitigating large-scale credential attacks, focusing on recent campaigns targeting security vendors…
6. Unpatchable 'usbliter8' Exploit Breaks Apple A12 and A13 SecureROM Boot Chain
   — The Hacker News
   
   Security researchers at Paradigm Shift have published a working exploit, dubbed usbliter8, that achieves arbitrary code execution inside …
7. The Gentlemen RaaS Uses GentleKiller EDR Framework Targeting 400 Security Processes
   — The Hacker News
   
   The Gentlemen ransomware-as-a-service (RaaS) operation is actively developing and maintaining a suite of endpoint detection and response (ED…
8. Stressors, AI Forcing Changes to Cybersecurity Teams
   — Dark Reading
   
   As threats proliferate and AI complicates cybersecurity, CISOs say the job is getting harder, but more companies still want cybersecurity ex…
9. eBanking Phishing Delivered Through IPv4-Mapped IPv6 Address, (Fri, Jun 19th)
   — SANS ISC
   
   I detected an interesting phishing email this morning. It targets a major Belgian bank:
10. Novo Nordisk Breach Exposes Software Development Pipeline Risk
    — Dark Reading
    
    A leaked GitHub token underscores what most organizations get wrong: Treating secrets management as a tooling problem rather than an identit…
11. Operation Escaneo Signals Shift in LatAm Threat Landscape
    — Dark Reading
    
    The threat group's curious business model may combine opportunistic monetization alongside intel collection, without much coordination betwe…
12. ‘Popa’ Botnet Linked to Publicly-Traded Israeli Firm
    — Krebs on Security
    
    For the past four years, a sprawling Android-based botnet called Popa has forced millions of consumer TV boxes to relay Internet traffic lin…

Generated by CryptXNet.ai Threat Intelligence Platform · June 22, 2026 · Sources: The Hacker News, Bleeping Computer, Krebs on Security, Dark Reading, SANS ISC, THN Threat Intel, Unit 42, Security.com