Loading malware…
Prinz Eugen is a Go-based ransomware family associated with a hands-on-keyboard extortion operation that appears to be centrally run rather than offered as ransomware-as-a-service. Intrusions linked to this malware have been associated with compromised Remote Desktop Protocol access, abuse of legitimate remote management software such as RemotePC, and PowerShell-based staging activity. Reporting has also linked the operation to the threat actor ROOTBOY, including the aliases GERMANIA and avtokz, and to leak-site-based extortion in which stolen data may be used to pressure victims outside the victim environment rather than through an on-disk ransom note.
A defining characteristic of Prinz Eugen is its file-selection logic: it prioritizes encryption of the most recently modified files before older data, using alphabetical order only to break timestamp ties. This behavior is designed to maximize immediate operational disruption by targeting current work product, recently updated shared data, active documents, and other fresh business-critical content first. The malware recursively traverses accessible directories, attempts to encrypt nearly all reachable files except those already bearing its encrypted extension, and appends a dedicated extension to encrypted data.
Technical analysis has described Prinz Eugen as using ChaCha20-Poly1305 authenticated encryption with per-file randomness and a multi-stage key derivation chain involving Argon2id, SHA-256, and HKDF-SHA256. It processes data in chunks, performs integrity verification, and supports an optional mode that deletes original files only after confirming the encrypted copy can be successfully decrypted. The malware also exhibits anti-forensic and anti-recovery behavior by zeroing key material in memory, invoking garbage collection, and deleting itself after execution. Analysts have noted that examined samples did not drop a ransom note, create an HTML instruction page, or change the desktop wallpaper, indicating that extortion communications may occur through external channels such as leak portals or direct contact.
Observed intrusions indicate that operators use legitimate administration tools and built-in system utilities during post-compromise activity, including payload deployment and persistence establishment through creation of an administrator account. Victimology has included organizations in multiple countries, including financial and other enterprise targets. The combination of manual intrusion activity, data theft, stealthy encryption, and out-of-band extortion makes Prinz Eugen a disruptive ransomware threat with strong emphasis on operational pressure and reduced forensic recoverability.
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
A newly identified ransomware group is using remote management software and scripted attack tools to compromise organizations and deploy a sophisticated encryption threat called Prinz Eugen.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
According to the researchers, initial access is likely achieved through stolen RDP credentials... In an investigated incident, the researchers observed the use of the RemotePC RMM tool and a backdoor administrator account that provided persistence.
We suspect the actor gained a foothold through compromised RDP credentials.
Three domains resolved to the same server, including a typosquat of Standard Bank’s domain and a fake CAPTCHA page likely used to lure victims into executing malicious code.
Threatdown, Malwarebytes’ enterprise cybersecurity arm, found that the Prinz Eugen hackers have a hands-on-keyboard style and prefer to use legitimate remote monitoring and management (RMM) software and living-off-the-land tools.
In the environment ThreatDown investigated, the actor used RemotePC to launch PowerShell stagers and deploy additional payloads, a reminder that PowerShell-based malware can hide inside ordinary workflows.
The attacker also created a hidden admin account using the command net user admin germania /add... Before exiting, the malware... deletes itself using a timed Windows command.
According to the researchers, initial access is likely achieved through stolen RDP credentials... In an investigated incident, the researchers observed the use of the RemotePC RMM tool and a backdoor administrator account that provided persistence.
We suspect the actor gained a foothold through compromised RDP credentials.
In an investigated incident, the researchers observed the use of the RemotePC RMM tool and a backdoor administrator account that provided persistence.
The attacker also created a hidden admin account using the command net user admin germania /add, establishing a persistent foothold in the environment.
According to the researchers, initial access is likely achieved through stolen RDP credentials... In an investigated incident, the researchers observed the use of the RemotePC RMM tool and a backdoor administrator account that provided persistence.
We suspect the actor gained a foothold through compromised RDP credentials.
Three domains resolved to the same server, including a typosquat of Standard Bank’s domain and a fake CAPTCHA page likely used to lure victims...
It also supports an optional --delete flag that removes the original only after checking that the encrypted copy can be decrypted... The analyzed sample zeroes key material, runs garbage collection, and deletes itself after execution.
The operation's encryption strategy includes overwriting the encryption key with zeroes and self-deleting to prevent recovery.
According to the researchers, initial access is likely achieved through stolen RDP credentials... In an investigated incident, the researchers observed the use of the RemotePC RMM tool and a backdoor administrator account that provided persistence.
We suspect the actor gained a foothold through compromised RDP credentials.
The self-delete uses cmd.exe with a ping-delay trick, which gives the parent process time to exit fully before deletion runs: cmd.exe /C ping 127.0.0.1 -n 2 > nul & del /F /Q C:\Users\<redacted>\Music\servertool.exe
ThreatDown said the ransomware processes files by modification time, starting with the most recently changed files and using alphabetical order only when timestamps match.
In the environment ThreatDown investigated, the actor used RemotePC to launch PowerShell stagers and deploy additional payloads... RMM sessions outside normal administrative scope, off-hours connections, or activity from accounts without a change ticket should be treated as possible lateral movement signals.
In the incident analyzed, the attacker gained initial access through compromised Remote Desktop Protocol credentials.
In the environment ThreatDown investigated, the actor used RemotePC to launch PowerShell stagers and deploy additional payloads.
The available reporting and incident data point to a simple pressure model: steal the data, encrypt the environment, then use the leak site and direct contact channels to force a decision.
...pull additional payloads from a command-and-control server at 212.80.7.74.
The encryptor executable, named servertool.exe, was downloaded using Chrome and placed in the victim’s Music folder.
The attacker then used RemotePC, a legitimate remote management tool, to launch PowerShell stagers and pull additional payloads from a command-and-control server at 212.80.7.74.
Those payloads were likely remote access tools built for data theft and exfiltration. The threat gained wider attention as attackers escalated tactics, releasing stolen data in daily batches after the bank refused to pay.
The researchers noticed that when the malware uses the --delete flag to delete the original file after encrypting it, a check occurs to make sure that the file can be decrypted before removing it from the system.
ThreatDown said the ransomware processes files by modification time, starting with the most recently changed files and using alphabetical order only when timestamps match. The ransomware appends the .prinzeugen extension to encrypted files. ThreatDown said the sample uses ChaCha20-Poly1305 encryption, integrity checks, and a custom file header.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.