Prinz Eugen Go-Based Ransomware Linked to ROOTBOY Extortion Campaign

Researchers detailed a newly identified ransomware family called Prinz Eugen, a Go-based encryptor observed in a customer intrusion likely initiated through compromised RDP credentials. The attackers reportedly used RemotePC to deliver PowerShell-based payloads and created a persistence account named admin with the password germania. Once deployed, the malware recursively encrypts files while prioritizing recently modified data, uses ChaCha20-Poly1305 with integrity verification, and can delete original files after successful encryption.

The operation stood out for its anti-forensic behavior and extortion model. Prinz Eugen reportedly zeroes key material in memory, self-deletes, and avoids relying on a traditional on-disk ransom note, instead combining data theft, encryption, leak-site pressure, and out-of-band extortion. Researchers linked the activity to ROOTBOY, also known as avtokz, citing leak-site reporting, historical forum activity, reuse of the extortion alias GERMANIA, and German-themed naming patterns. Infrastructure tied to the campaign included 212.80.7.74 and related domains, including a Standard Bank typosquat, while observed victims included Standard Bank Group in South Africa and Transitions Pro Centre Val de Loire in France.