Overview
Ransomware operators are constantly evolving their tactics, but every so often a new threat emerges that challenges some of the assumptions security teams have become accustomed to.
A recently identified ransomware operation known as Prinz Eugen is doing exactly that.
Unlike many modern ransomware groups that rely on mass deployment, affiliate programmes, and highly visible ransom demands, Prinz Eugen takes a more deliberate approach. The malware prioritises recently modified files for encryption, avoids leaving traditional ransom notes, and relies heavily on legitimate administrative tools to blend into normal business operations.
The result is a ransomware operation that focuses on business impact rather than visibility, increasing pressure on victims while reducing opportunities for early detection.
Technical Summary
Researchers from ThreatDown, Malwarebytes’ enterprise security division, observed that Prinz Eugen operators favour a hands-on-keyboard approach rather than automated large-scale attacks.
Initial access is believed to occur through:
- Stolen Remote Desktop Protocol (RDP) credentials
- Legitimate remote management tools
- Manual execution of ransomware payloads
- Persistence through administrator accounts
In one investigated incident, attackers used:
- RemotePC remote management software
- A backdoor administrator account
- Manual deployment of the ransomware payload
This approach allows attackers to operate in a manner that often resembles legitimate administrative activity.
Why Prinz Eugen Is Different
Many ransomware groups today operate under the Ransomware-as-a-Service (RaaS) model.
In those operations:
- Developers create the malware.
- Affiliates perform the attacks.
- Profits are shared.
Prinz Eugen appears to operate differently.
Researchers have not observed evidence that the group is actively recruiting affiliates or operating as a traditional RaaS platform.
This suggests a smaller, more controlled operation where the attackers retain direct oversight of their campaigns.
While the number of publicly listed victims remains relatively small, security researchers believe the true number of affected organisations is higher.
A Smarter Encryption Strategy
Perhaps the most interesting aspect of Prinz Eugen is its file selection strategy.
Rather than encrypting files randomly, the ransomware prioritises files based on modification timestamps.
In simple terms:
Most Recently Modified Files First
The ransomware targets files that employees are actively working on.
Examples may include:
- Current projects
- Financial spreadsheets
- Operational documents
- Active databases
- Customer records
Researchers believe this is designed to maximise business disruption as quickly as possible.
The logic is straightforward.
If attackers can immediately impact the files employees rely on every day, operational pressure increases significantly.
How the Encryption Works
The malware is written in Go and uses modern cryptographic techniques.
Observed components include:
- ChaCha20-Poly1305 encryption
- Argon2id key derivation
- SHA-256 hashing
- HKDF-SHA256 key generation
Files are encrypted in 1 MB chunks while integrity checks are performed throughout the process.
An interesting feature observed by researchers is that the malware verifies whether encrypted files can be successfully decrypted before deleting the original versions.
From an attacker perspective, this reduces the risk of accidental corruption that could make victim recovery impossible and reduce the likelihood of a ransom payment.
Anti-Forensic Techniques
Prinz Eugen also demonstrates a strong focus on reducing forensic evidence.
After encryption:
- Encryption keys are overwritten with zeros.
- Memory is cleared through forced garbage collection.
- The ransomware removes itself from disk.
Researchers also observed that the malware does not:
- Change desktop wallpapers
- Create traditional ransom notes
- Leave obvious victim notifications
Instead, communications are believed to occur through external channels such as:
- Telephone contact
- Dark web portals
This reduces forensic artifacts and can make automated detection of the extortion phase more difficult.
Why Living-Off-the-Land Attacks Matter
One of the most concerning aspects of this campaign is not the encryption itself.
It is the attack methodology.
The use of:
- Legitimate remote management tools
- Valid administrator accounts
- RDP access
- Standard operating system utilities
means attackers can blend into normal activity.
This is often referred to as a “Living-Off-the-Land” approach.
Rather than introducing obviously malicious software, attackers abuse tools that organisations already trust.
As a result, traditional signature-based detection becomes less effective.
Defensive Recommendations
Organisations should consider the following defensive measures:
Strengthen RDP Security
- Disable unnecessary RDP exposure.
- Use MFA on all remote access services.
- Restrict access through VPNs and allowlists.
Monitor Remote Management Tools
Review usage of:
- RemotePC
- TeamViewer
- AnyDesk
- ScreenConnect
- Other RMM platforms
Unexpected deployments should be investigated immediately.
Detect Privileged Account Abuse
Monitor:
- New administrator accounts
- Unusual privilege escalation
- After-hours administration activity
Maintain Offline Backups
Recovery remains the most effective response to ransomware.
Ensure backups are:
- Offline
- Immutable
- Regularly tested
Deploy Behaviour-Based Detection
Modern ransomware often bypasses traditional antivirus solutions.
EDR and behavioural monitoring can help identify:
- Mass file modification
- Unusual encryption activity
- Credential abuse
- Suspicious remote access
Expert in the Cloud Insight
Prinz Eugen highlights a trend that security leaders should pay close attention to.
The most dangerous ransomware groups are no longer the loudest ones.
Instead of focusing on splash screens, ransom notes, and mass infections, attackers are increasingly prioritising stealth, business disruption, and operational efficiency.
The decision to encrypt recently modified files is particularly revealing. It demonstrates an understanding of how businesses actually operate. Attackers are no longer simply encrypting data; they are targeting the information organisations depend on most.
The use of legitimate administrative tools is equally significant. Security teams can no longer assume that malicious activity will always appear obviously malicious.
As ransomware operations mature, defenders must shift from focusing solely on malware detection to understanding behaviour, identity, and operational risk.
Ultimately, the lesson from Prinz Eugen is clear: modern ransomware is becoming quieter, more targeted, and more strategic. Organisations that rely solely on traditional perimeter security will increasingly struggle to identify these threats before significant damage occurs.
Expert in the Cloud – The Future Is Now.
Leave a Reply