New Prinz Eugen Ransomware Targets Recently Modified Files, Skips Ransom Notes A newly identified ransomware operation, Prinz Eugen, is employing a stealthy and targeted approach to encryption, prioritizing recently modified files while avoiding traditional ransom notes. Discovered by Threatdown (Malwarebytes’ enterprise cybersecurity team), the group operates with a hands-on-keyboard style, leveraging legitimate remote monitoring and management (RMM) tools and living-off-the-land techniques to evade detection. Initial access is believed to occur via stolen RDP credentials, followed by the manual deployment of the servertool.exe payload. In one observed attack, the threat actors used the RemotePC RMM tool and created a backdoor administrator account for persistence. Unlike most modern ransomware groups, Prinz Eugen does not follow the ransomware-as-a-service (RaaS) model and is not actively recruiting affiliates. The ransomware, written in Go, encrypts files based on modification timestamps, processing the most recently altered files first likely to maximize disruption by targeting active, business-critical data. When multiple files share the same timestamp, they are encrypted in alphabetical order. The malware scans directories recursively without depth limits or exclusions, encrypting nearly all files except those already marked with the .prinzeugen extension. Encryption is performed using ChaCha20-Poly1305 with a 32-byte master key, a per-file random initialization vector, and a key derivation process involving Argon2id, SHA-256, and HKDF-SHA256. Files are encrypted in 1 MB chunks, with integrity verified via SHA-256 hashing. Before deleting the original file (when the --delete flag is used), the malware ensures the encrypted version can be decrypted. To prevent key recovery, it overwrites the encryption key with zeroes, forces garbage collection to clear memory, and self-deletes from disk. Notably, Prinz Eugen does not drop a ransom note or alter the desktop wallpaper a tactic increasingly adopted by organized ransomware groups to minimize forensic traces and complicate automated detection. Instead, extortion communications are conducted out-of-band, via direct email, phone, or dark web portals. As of now, Prinz Eugen’s leak site lists only three victims, though researchers are aware of additional impacted organizations. In one case involving Standard Bank, the attackers demanded 1 BTC, which was reportedly refused. The group’s current activity suggests a focused, low-volume approach, distinguishing it from larger RaaS operations. Indicators of compromise have been shared to aid detection and defense efforts.