Prinz Eugen Ransomware Targets Recently Modified Files, Skips Ransom Notes ThreatDown researchers have uncovered a new Go-based ransomware strain, Prinz Eugen, that prioritizes encrypting the most recently modified files leaving organizations vulnerable to data loss before backups can catch up. Unlike traditional ransomware, it does not drop a ransom note on disk, complicating detection and response efforts. The malware encrypts files in order of modification time, appending the .prinzeugen extension, and uses ChaCha20-Poly1305 encryption with integrity checks. A unique feature is its optional --delete flag, which removes original files only after verifying encrypted copies can be decrypted. This approach risks same-day work such as active databases, cloud-synced files, or shared drives falling outside the latest clean backup window. Without a ransom note, wallpaper change, or other visible demands, Prinz Eugen evades traditional detection methods reliant on these artifacts. Organizations with tight recovery point objectives (RPOs) or high-volume file changes may find critical data unrecoverable if backups lag even slightly. The attack chain observed by ThreatDown involved RemotePC sessions used to deploy PowerShell stagers, highlighting how legitimate remote management tools can be abused for lateral movement. The ransomware also clears encryption keys, runs garbage collection, and deletes itself post-execution, further limiting recovery options. To counter such threats, security teams are advised to validate backup coverage for recently modified files, supplement ransom-note-based playbooks with behavioral detection (e.g., rapid file writes, unusual access patterns), and monitor for off-hours RMM activity or unauthorized PowerShell usage. The incident underscores gaps in conventional ransomware response protocols when attackers bypass traditional indicators.