Reported by 1 outlet
Prinz Eugen Ransomware Prioritizes Recent Files, Operates Without Ransom Note
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Prinz Eugen Ransomware Prioritizes Recent Files, Operates Without Ransom Note
bleepingcomputer.com · 115d ago · June 21st, 2026
Malwarebytes' Threatdown team has identified a new hands-on-keyboard ransomware operation named Prinz Eugen with several unusual characteristics.
Key findings from the investigation:
-
Initial access: Stolen RDP credentials, followed by manual payload deployment (
servertool.exe) -
RMM abuse: RemotePC tool used for persistence via backdoor admin account
-
Encryption: Go-based binary using ChaCha20-Poly1305 with Argon2id/SHA-256/HKDF-SHA256 key derivation; processes files in 1 MB chunks with SHA-256 integrity verification
-
Targeting prioritization: Most recently modified files encrypted first; when timestamps tie, alphabetical order — designed to maximize pressure on victims by hitting business-critical data in active use
-
Anti-forensics: Encryption key overwritten with zeroes, garbage collection forced, then self-deletes from disk
At least 5 victims identified by researchers, with only 3 currently listed on the leak site. In one incident (Standard Bank), the attacker demanded 1 BTC and was refused.
-