Prinz Eugen

We suspect the actor gained a foothold through compromised RDP credentials.

we also observed the actor leveraging the RemotePC RMM tool to launch PowerShell stagers and deploy additional payloads.

We suspect the actor gained a foothold through compromised RDP credentials.

We observed the actor setting up an admin account as well: net user admin germania /add

We observed the actor setting up an admin account as well: net user admin germania /add

We suspect the actor gained a foothold through compromised RDP credentials.

Prinz Eugen is a new Go-based ransomware family that encrypts files, prioritizes fresh data, and extorts victims out-of-band, leaving a deliberate, anti-forensic footprint.

Before exiting... it zeroes the hardcoded encryption key and runs the garbage collector... then deletes itself... cmd.exe /C ping 127.0.0.1 -n 2 > nul & del /F /Q C:\Users\<redacted>\Music\servertool.exe

We suspect the actor gained a foothold through compromised RDP credentials.

The self-delete uses cmd.exe with a ping-delay trick, which gives the parent process time to exit fully before deletion runs: cmd.exe /C ping 127.0.0.1 -n 2 > nul & del /F /Q C:\Users\<redacted>\Music\servertool.exe

We suspect the actor gained a foothold through compromised RDP credentials.

Reporting on the Standard Bank intrusion adds further tradecraft: a hands-on dwell time of around three weeks before exfiltration, and lateral movement through enterprise applications including SharePoint, OneDrive, Power Apps, AppDynamics, Jira, Confluence, Citrix, Remedy, and Microsoft and Oracle SQL databases.

The available reporting and incident data point to a simple pressure model: steal the data, encrypt the environment, then use the leak site and direct contact channels to force a decision.

Once inside, they downloaded the encryptor executable ( servertool.exe ) using Chrome and moved it into the user’s Music folder.

In the environment hit by this ransomware, we also observed the actor leveraging the RemotePC RMM tool to launch PowerShell stagers and deploy additional payloads.

we suspect this IP is acting as a C2, and the additional payloads are probably remote access trojans (RATs) used for infostealing and exfiltration.

The encryptor performs a fully recursive walk with no depth limit... encrypt every file that does not already carry the .prinzeugen extension... It first creates and encrypts a temporary copy... then renames that temporary file to its final form, document.docx.prinzeugen.