New Prinz Eugen ransomware prioritizes recent files for encryption

1. Executive summary

A new ransomware operation dubbed Prinz Eugen has been observed targeting organisations with a hands-on-keyboard approach, prioritising recently modified files for encryption and omitting any on-system ransom note. Initial access is achieved via stolen RDP credentials, followed by manual deployment of a Go-based payload (servertool.exe) and abuse of legitimate remote monitoring and management (RMM) tooling — specifically RemotePC — with persistence established through a backdoor administrator account. The operation is not structured as ransomware-as-a-service and is not currently recruiting affiliates; at least five victims have been identified, including a financial-sector target (Standard Bank) where a 1 BTC ransom demand was refused. Attribution to a named actor "Prinz Eugen" is unconfirmed — no MITRE ATT&CK profile exists for this actor. The combination of stolen RDP, RMM abuse, and absence of a ransom note materially raises the detection and response burden for EMEA financial services firms.

2. Regulatory framing

3. Technical analysis & attack chain

1. Initial access — stolen RDP credentials. Threatdown assesses initial access is achieved via stolen Remote Desktop Protocol credentials. No specific CVE is associated with this vector; it is credential-based rather than vulnerability-based.
2. Reconnaissance & tooling staging. Operators work hands-on-keyboard, preferring legitimate RMM software and living-off-the-land binaries over custom tooling.
3. RMM deployment — RemotePC. The RemotePC RMM tool is installed and used for remote access and persistence. RemotePC is a legitimate third-party remote-access product; abuse of such tools is a common TTP in modern ransomware intrusions.
4. Persistence — backdoor administrator account. A backdoor administrator account is created on compromised hosts, providing re-entry independent of the RMM tool.
5. Payload execution — servertool.exe. The main Go-based payload is downloaded and executed manually. The binary name is servertool.exe.
6. Encryption. ChaCha20-Poly1305 encryption is applied with a 32-byte master key, a random per-file IV, and a key derivation function based on Argon2id, SHA-256, and HKDF-SHA256. Encryption proceeds in 1 MB chunks; file integrity is verified via SHA-256.
7. File selection logic. Directories are walked recursively with no depth limit and no exclusions. The malware prioritises the most recently modified files; ties on modification timestamp are broken alphabetically. Encrypted files are renamed with the .prinzeugen extension. All files except those already bearing .prinzeugen are eligible.
8. Secure deletion (when --delete flag is used). Before deletion, the malware verifies the encrypted file can be decrypted. The encryption key is then overwritten with zeroes, garbage collection is forced to evict it from memory, and the malware self-deletes from disk.
9. No ransom note, no wallpaper change. No ransom note is dropped and the desktop wallpaper is not altered. Extortion communications occur entirely out-of-band (email, phone, dark-web portal), reducing forensic artefacts and complicating automated detection of the extortion phase.
10. Extortion & leak site. A data leak site is operated; three victims are publicly listed, with at least five victims known to researchers. In the Standard Bank incident, a 1 BTC ransom was demanded and refused.

Unconfirmed / single-source claims. The actor name "Prinz Eugen" and the absence of a RaaS model are reported solely by Threatdown/Malwarebytes in this incident. Attribution to any named threat actor is unconfirmed — no MITRE ATT&CK profile exists for "Prinz Eugen". The full IOC list referenced by Threatdown is not reproduced in the source material; defenders should consult the ThreatDown report directly for the authoritative indicator set.

4. Mitigation & containment

P1 — within 24 hours

• Isolate any host exhibiting servertool.exe execution or .prinzeugen file creation; disconnect from network and preserve memory and disk for forensics.
• Audit and disable unauthorised administrator accounts; review local and domain account creation events for the last 90 days. Remove any account not formally approved.
• Inventory RemotePC (and other RMM) installations across the estate. Where RemotePC is not a sanctioned business tool, uninstall and block the binary at the EDR/AV level. Where it is sanctioned, restrict to approved users and enforce MFA.
• Reset and rotate any credentials that may have transited an RDP-exposed system, including local administrator passwords and any credentials cached on RemotePC-managed endpoints.
• Block outbound traffic from endpoints to known RemotePC infrastructure where business use does not require it; enforce egress filtering.

P2 — within 72 hours

• Patch and harden RDP exposure. Disable RDP where not required; where required, enforce Network Level Authentication (NLA), restrict source IPs, enforce account lockout policies, and require phishing-resistant MFA.
• Review EDR/SIEM detections for the chain: RemotePC process → servertool.exe execution → new local admin account → mass file rename to .prinzeugen. Tune or author detections as per Section 6.
• Validate backups for recoverability and isolation from production networks. Confirm at least one offline / immutable backup set exists.
• Engage legal and communications in line with DORA Art. 19 / NIS2 Art. 23 reporting timelines if a Prinz Eugen incident is confirmed.

P3 — within 7 days

• Conduct a focused third-party risk review of all RMM/remote-access vendors under DORA Art. 28; document RemotePC usage, contractual terms, and exit provisions.
• Run a tabletop exercise simulating a Prinz Eugen-style intrusion (RDP → RMM → encryption with no ransom note) to validate incident response and out-of-band extortion handling.
• Threat-intel integration: ingest ThreatDown's IOC list into the SIEM and block at perimeter/EDR.

5. Indicators of compromise

filename  servertool.exe
file_extension  .prinzeugen
rmm_tool  RemotePC

Additional IOCs (file hashes, C2 domains/IPs, mutexes) are referenced in the ThreatDown report but are not reproduced in the source material supplied for this advisory. Defenders should retrieve the full IOC set directly from the ThreatDown publication before actioning.

6. Detection

YARA rule — string-based, built from confirmed artefacts in the source material.

rule AT_PrinzEugen_Ransomware_2026_06_20
{
    meta
        author      = "Adverse Trace"
        date        = "2026-06-20"
        description = "Detects Prinz Eugen ransomware payload or encrypted-file artefacts based on confirmed strings"
        reference   = "https://www.bleepingcomputer.com/news/security/new-prinz-eugen-ransomware-prioritizes-recent-files-for-encryption/"
        tlp         = ""

    strings
        $payload_name    = "servertool.exe" ascii nocase wide
        $ext_marker      = ".prinzeugen" ascii nocase wide
        $actor_marker    = "Prinz Eugen" ascii nocase wide
        $crypto_marker   = "ChaCha20-Poly1305" ascii nocase wide
        $kdf_marker      = "Argon2id" ascii nocase wide
        $hkdf_marker     = "HKDF-SHA256" ascii nocase wide

    condition
        any of ($payload_name, $ext_marker) or
        2 of ($actor_marker, $crypto_marker, $kdf_marker, $hkdf_marker)
}

Sigma rule — behavioural detection for the observed attack chain.

title: Prinz Eugen Ransomware Indicators (servertool.exe + RemotePC + new admin account)
id: AT-2026-06-20-134
status: experimental
description: |
  Detects the Prinz Eugen ransomware attack chain: RemotePC RMM activity,
  execution of servertool.exe, creation of a new local administrator account,
  and renaming of files to .prinzeugen. Reference: BleepingComputer / Threatdown.
author: Adverse Trace
date: 2026-06-20
references:

  - https://www.bleepingcomputer.com/news/security/new-prinz-eugen-ransomware-prioritizes-recent-files-for-encryption/
logsource:
  product: windows
  category: process_creation
detection:
  selection_process:
    Image|endswith:

      - "\servertool.exe"
    ParentImage|endswith:

      - "\RemotePC.exe"
  selection_account:
    EventID: 4720
    TargetUserName: "*"
  selection_rename:
    EventID: 4663
    ObjectName|endswith: ".prinzeugen"
  condition: selection_process or selection_account or selection_rename
falsepositives:

  - Legitimate RemotePC deployments (review with asset inventory)
level: high
tags:

  - attack.initial_access
  - attack.persistence
  - attack.impact
  - attack.t1486  # Data Encrypted for Impact

7. Sources

• BleepingComputer, "New Prinz Eugen ransomware prioritizes recent files for encryption", 20 June 2026. https://www.bleepingcomputer.com/news/security/new-prinz-eugen-ransomware-prioritizes-recent-files-for-encryption/

8. Adverse Trace position

Severity: Moderate-High for EMEA financial services. Prinz Eugen is a nascent, hands-on-keyboard operation rather than a high-volume RaaS, which limits blast radius but also means tradecraft is bespoke and harder to fingerprint. The combination of stolen RDP, abuse of legitimate RMM (RemotePC), a backdoor admin account, and the deliberate absence of an on-host ransom note materially raises the detection and response burden — particularly for firms with exposed RDP or unmanaged RMM deployments. Attribution to any named actor is unconfirmed; "Prinz Eugen" is the operation's chosen name, not a MITRE-mapped threat group. Next steps: (1) retrieve and ingest the full ThreatDown IOC list into SIEM/EDR; (2) audit RemotePC and equivalent RMM usage across the estate; (3) validate incident response playbooks for out-of-band extortion scenarios; (4) prepare DORA Art. 19 / NIS2 Art. 23 reporting templates in advance of any confirmed incident.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.