Last Friday, citing unspecified national security concerns, the White House ordered Anthropic to restrict the export of its powerful AI models Fable and Mythos to anyone outside of the United States, as well as foreign nationals inside the country. Shortly after, the AI giant hastily pulled the plug on both models, which have now been unavailable to anyone for a week. 

The episode is the first real test of whether the U.S. government can use export controls to contain frontier AI the way it has tried, with very uneven results, to contain encryption and spyware before it. And dramatic as it may sound, how this standoff gets resolved could shape not just Anthropic’s access to foreign markets but the rulebook that other AI labs will have to build around.

Some context first. Ever since Anthropic launched Mythos in April, the company has marketed it as some kind of Doomsday cyber machine that could wreak havoc on the internet if released too widely — which is why, before the ban, only around 150 vetted companies and government organizations had access to it at all. The goal was helping defenders secure their software and services before the bad guys could reach Mythos-like capabilities. 

So what triggered the ban? Two subsequent events, reportedly. The first: Anthropic gave a South Korean telecom access to Mythos through its limited partner program, and U.S. officials grew alarmed after identifying the company as one they suspected had ties to China. (The company, widely reported to be SK Telecom, has denied any China connection.) Amazon CEO Andy Jassy also reportedly alerted the administration after Amazon’s own researchers, he said, found a way around Fable 5’s safeguards. Anthropic disputes the “jailbreak” label, calling it a narrow, already-patched issue rather than a wholesale defeat of the model’s safety measures.

The result was the same: the Commerce Department issued an export control directive, and Anthropic had to scramble to immediately limit access to its products — within roughly 90 minutes of being notified, by some accounts.

None of this is new, though. Governments have tried to use export controls to limit the proliferation of what they see as dangerous cyber technology for decades, but their track record has been middling at best. 

The U.S. government was behind what is perhaps history’s most spectacular failure of this approach in the early to mid-1990s. At the time, computer scientists were developing encryption technologies to secure data as it traveled over the internet. One of those encryption products was called Pretty Good Privacy, or PGP, a popular software that could encrypt data and make it virtually impossible to unscramble even if intercepted as it traveled to its intended recipient over the internet. 

The U.S. government initially saw PGP as a dangerous weapon, fearing it would prevent its intelligence agencies from snooping on emails as they crossed their wires. To stop the distribution of PGP, the U.S. Customs Service opened a criminal investigation against PGP’s creator Phil Zimmermann for allegedly violating arms export controls. He fought back by publishing PGP’s source code as a printed book, igniting what is known today as the “Crypto Wars.” 

Zimmermann later won a key battle when the investigation was closed, paving the way for crucial end-to-end encryption algorithms such as the one used by billions of Signal and WhatsApp users. 

Later during the early 2010s, researchers began discovering Western-made spyware used against dissidents in the Middle East. In response, several governments agreed to expand the Wassenaar Arrangement, an international treaty that limits the export of dual-use software and technologies that are used in both civilian and military applications.

The idea was to classify surveillance and hacking software as dual-use, thus forcing spyware makers to get export licenses to sell their products abroad. 

But Wassenaar has always had two inherent weaknesses. There are several countries that don’t adhere to the agreement, including Israel, which houses some of the world’s most active spyware makers.

The agreement also depends on countries applying it to companies within their borders at their own discretion. For a time, the Italian government allowed one of the country’s then-top spyware makers, Hacking Team, a license to export its tools around the world, despite the company’s track record of selling spyware to oppressive governments that used it to hack journalists and human rights activists. 

Since then, other countries in Europe have been lax with spyware makers like Italy. Despite numerous scandals, Europe, home to many spyware and hacking tools makers, has continually failed to curb the export of spyware to authoritarian regimes. Critics say that a recently renewed effort across the bloc of 27 member states to tackle its growing problem of spyware exports to authoritarian states “does not go far enough.”

Several spyware makers, such as Intellexa, a sanctioned consortium of spyware companies,  have simply moved their operations to countries with lax export controls. Other spyware makers sought to move their operations to Saudi Arabia for similar reasons.

There have been some wins. Germany-based spyware maker FinFisher shut down in 2022 after a multi-year investigation by German prosecutors into the company for allegedly selling spyware to Turkey without an export license. Investigators previously found the FinFisher spyware had been deployed on the phones of critics of Turkey’s government. 

As of the time of writing, the impasse between Anthropic and the Trump administration remains. There is a reasonable chance the administration will buckle and lift the restriction in the interest of keeping American AI companies competitive worldwide — a move that would amount to tacit acknowledgment that AI labs elsewhere, including in China, will likely reach similar capabilities regardless of what the U.S. restricts. Or, American AI companies could end up needing government approval before serving foreign customers at all, a compliance burden that would invariably dent their bottom line. 

Given the past experiences that world governments have had with trying to control the reach of software, government-mandated export controls are unlikely to be the right approach to stop malicious actors from abusing powerful dual-use cyber technologies.

A new ransomware operation named ‘Prinz Eugen’ prioritizes recently modified files for encryption and leaves no ransom note on the system.

An investigation from Threatdown, Malwarebytes’ enterprise cybersecurity arm, found that the Prinz Eugen hackers have a hands-on-keyboard style and prefer to use legitimate remote monitoring and management (RMM) software and living-off-the-land tools.

According to the researchers, initial access is likely achieved through stolen RDP credentials, followed by the manual download and execution of the main payload, ‘servertool.exe.’

In an investigated incident, the researchers observed the use of the RemotePC RMM tool and a backdoor administrator account that provided persistence.

Unlike many modern extortion operations, Prinz Eugen does not operate under the ransomware-as-a-service (RaaS) model, and its developers are not currently recruiting affiliates.

Unlike most extortion operations, Prinz Eugen is not a ransomware-as-a-service (RaaS), or at least the developers are not currently looking for affiliates.

Currently, the threat actor’s data leak site only lists three victims, each one showing that the hackers engage in data encryption, exfiltration, or both. However, the cybersecurity community is aware of more organizations impacted by Prinz Eugen ransomware.

Encryption strategy

An analysis of a Prinz Eugen attack revealed that the Go-based malware prioritizes the encryption of the most recently modified files. When multiple files share the same timestamp, they are processed in alphabetical order.

Threatdown researchers believe this approach is intended to maximize the impact on victims by targeting files that are more likely to be business-critical and in active use, increasing the pressure to pay the ransom.

The analyzed sample checks directories recursively with no depth limit and no exclusions, and encrypts virtually every file except those with the .prinzeugen extension, which Prinz Eugen uses for encrypted files.

The ransomware employs ChaCha20-Poly1305 encryption with a 32-byte master key, a random initialization vector for each file, and a key derivation function based on Argon2id, SHA-256, and HKDF-SHA256.

The encryption process is carried out in 1 MB chunks, and file integrity is checked using the SHA-256 hash function.

The researchers noticed that when the malware uses the –delete flag to delete the original file after encrypting it, a check occurs to make sure that the file can be decrypted before removing it from the system.

To prevent the encryption key from being retrieved, Prinz Eugen ransomware overwrites it with zeroes, forces garbage collection to eliminate it from memory, and then self-deletes from disk.

Analysis of the encryptor showed no functionality to drop a text ransom note or change the desktop wallpaper. Threatdown researchers say that the absence of a ransom note “is a tactic we see more often among organized ransomware groups.”

This is typically done to reduce the forensic footprint and make it more difficult for the extortion step to be detected automatically.

“By moving ransom communications entirely out-of-band (through direct email, phone contact, or dark-web victim portals), the actor reduces forensic artifacts and complicates automated detection of the extortion phase,” the researchers say.

The researchers identified at least five Prinz Eugen victims, saying that in the case of the Standard Bank breach, the attacker demanded a ransom of 1 BTC and was refused.

ThreatDown’s report provides a list of indicators of compromise to help both organizations and researchers analyze, detect, and defend against Prinz Eugen ransomware attacks.

Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.

The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.

Advertisement

Get the whitepaper

Salome Mikadze-Struk is no stranger to adversity. The daughter of refugees, she built a software-development business as an undergraduate at the height of the COVID-19 pandemic and kept it running despite the outbreak of war in her native Ukraine. Now, she’s drawing on her experiences to mentor tech-startup founders and speak publicly about the importance of resilience in entrepreneurship.

Mikadze-Struk was studying at Georgetown University, in Washington, D.C., when COVID-19 struck. Classes went online, and she moved back to Ukraine. In the midst of that disruption she saw an opportunity to develop her business idea, called Movadex, by tapping Ukraine’s pool of talented young engineers. Then Russia invaded in early 2022, during her final semester. Taking online classes from bomb shelters and helping employees evacuate to safer parts of the country was surreal, she says, but the team kept the company afloat and she graduated later that year.

In 2023, Mikadze-Struk took a hiatus from her business to pursue an MBA at Stanford University, which she completed this year. In her precious spare time she’s been advising startups and giving talks, using her unique perspective to promote the need for resilience in entrepreneurship—something she thinks is increasingly important in the software industry as AI coding tools upend old business models.

“You need to be okay with risk, you need to be resilient. You need to be okay with disruption and okay with uncertainty,” she says, “because this is inevitably going to be part of this industry for the foreseeable future.”

An Early Focus on Education

Mikadze-Struk’s parents had settled in Ukraine after fleeing conflict in the Abkhazia region of Georgia in the early 1990s. “They left everything behind,” she says. “You can look on Google Maps and zoom in on where their houses were and it’s all rubble.”

Despite this backstory, Mikadze-Struk says she and her sister had a conventional middle-class upbringing in Kyiv. Her father ran a small shop and her mother was a stay-at-home mom. Her parents placed an emphasis on education and encouraged her to study hard and take part in extracurricular programs such as Ukraine’s Junior Academy of Sciences, which introduces students to research.

“They weren’t rich, so they knew that our way to make it in life was not through investments, but through merit-based accomplishments,” she says.

When Mikadze-Struk was 14, her family discovered the newly launched Ukraine Global Scholars program, a nonprofit that helps talented students secure scholarships abroad. The program helped her win a full scholarship to the Emma Willard School, a private girl’s school in Troy, N.Y.

Discovering Tech

After graduating high school in 2018, Mikadze-Struk was accepted to Georgetown to study business administration. But it was outside the classroom that her career direction began to take shape. She won a startup competition with a medical device she had developed for a school project and, while the business idea didn’t go anywhere, it sparked an interest in entrepreneurship.

Ukraine’s software industry was booming, and she began attending startup events and competitions in her home country the summer before starting college. There she met her eventual cofounder Nor Newman.

Despite both being just 18, they saw a gap in the market. The pair noticed many founders had strong ideas but lacked the technical expertise to realize them, while talented engineering students often struggled to gain real-world experience. Newman had begun informally connecting startups with his college friends, but the pair soon saw commercial potential. “We realized we could actually create our own startup studio and help startups as a team, versus just connecting people,” says Mikadze-Struk.

Then, when the COVID-19 pandemic struck in early 2020, halfway through her sophomore year, it brought both disruption and opportunity for Newman and Mikadze-Struk. While travel restrictions and lockdowns made life complicated, there was also a surge of companies looking to move their business online. “COVID really skyrocketed everything we were doing,” she says.

Sensing an opportunity, Mikadze-Struk and Newman incorporated Movadex in Ukraine in early 2020. From the start, they decided to focus on not only providing engineering talent, but also helping startups with product development. Many times, says Mikadze-Struk, a founder’s vision for the software doesn’t line up with what users actually want. “What really helped us grow is not just the engineering or quality of code, but rather a holistic approach to creating a product and actually getting into the brain of the user,” she says.

Navigating Adversity

Back in Ukraine, Mikadze-Struk had to juggle this booming business with studying remotely—taking classes at night and working during the day. It was exhausting, she says, but it also allowed her to immediately apply what she learned in business classes to building her startup.

Having successfully navigated the pandemic, Mikadze-Struk was dealt another wild card. In early 2022, Russia invaded Ukraine and her life was again turned upside down. It was particularly traumatic for her family, having already been forced from their home in Georgia once by war.

In 2023, Mikadze-Struk took an extended leave from her company to pursue an MBA at Stanford.Christie Hemm Klok

“For my parents to experience their daughters going through all the same things they had gone through was really heartbreaking,” she says. “But at the same time, because I’d heard so much about their story of resilience I had power in me to not fully break down.”

On the day of the invasion the founders told employees to take the day off and emailed clients to warn of potential disruptions. The next couple of days were spent checking on staff and evacuating as many as possible to their headquarters in Lviv, in Western Ukraine.

By the following Monday the business was back up and running. Soon afterward, they partnered with the Lviv IT Cluster business association’s nonprofit arm to help resettle refugees from the eastern part of Ukraine, where strikes were focused, and offer job placements. Throughout this period, Mikadze-Struk was also completing her final year at Georgetown remotely. “Half of my senior year was actually spent in bomb shelters,” she says.

Promoting Resilience in Entrepreneurship

That summer, Mikadze-Struk graduated with a bachelor’s degree in business administration and learned she had been accepted onto Stanford University’s MBA program. In 2023, she took an extended leave from Movadex and moved to California. She also gave birth to her daughter in 2024.

Balancing studies and parenthood was already a full-time job, but she continued to engage with the startup ecosystem by volunteering as a startup mentor and public speaker. Now, after graduating from Stanford, she is stepping back into a more active leadership role at Movadex, where she hopes to drive the company’s expansion into the United States. She also wants to develop a stronger focus on helping customers understand and implement AI in their businesses.

While AI is undeniably disrupting the tech industry, Mikadze-Struk, now an IEEE Senior Member, is fundamentally optimistic about its impact. “The way AI democratized access to building software and to prototyping…is just mind blowing,” she says.

But it will require a significant shift in mind-set for engineers, especially junior developers hunting for jobs. They need to “fall in love with AI” and embrace it as a powerful copilot, she says. As these tools increasingly take over the nuts-and-bolts work of coding, engineers also need to nurture higher-level skills like systems thinking and architectural design.

Perhaps most importantly, given the rapid pace at which the technology is evolving, engineers need to nurture their adaptability and resilience. “It’s both exciting and scary, because you don’t know what tomorrow will bring.”

After a conflict between guards and farmers nearly ended in violence, Tata’s Indian iPhone factory is now facing health authority accusations of contamination.

Early on June 15, 2026, India’s Tamil Nadu Pollution Board (TNPCB) was reportedly threatening to force a shutdown of Tata’s iPhone plant. It followed a series of inspections that reportedly found contaminated wastewater had reached local wells.

Tata was also accused of failing to respond to the TNPCB’s complaints, but then on June 16, the case was dropped. Tata said first that its independent study showed it was following regulations, and then that the India regulator had now “dropped any further course of action on this issue.”

Now according to Reuters, however, the local Indian health authority in the district is still pursuing a case based on complaints from local farmers. As reported to Tata, an inspection found discharge with a “severe foul smell,” and left water “unsuitable for animals to drink.”

That report to Tata also said that local people had been getting skin-related health issues due to the contamination.

Separately, a group of farmers crossed onto Tata’s land on June 15 to photograph a reportedly contaminated pond. A Tata guard is said to have fetched a firearm, after which the group claims to have said “shoot us,” before the security officer backed down.

It appears that this health investigation has been running since at least late May 2026. That’s when the TNPCB reportedly concluded its own inspections.

The factory makes back panels and other iPhone components. Tata has been growing its iPhone manufacturing since 2023 when it bought Wistron’s plant, and then went into partnership with Pegatron.

Neither Tata nor Pegatron has commented on the latest report. Apple has not commented publicly either.