Prinz Eugen ransomware encrypts your newest files first

A new ransomware strain called Prinz Eugen has a small, mean idea at its core: encrypt the files you cared about most recently, first. It sorts everything on disk by modification time and starts at the top. Whatever you were working on this morning is what you will be negotiating over this afternoon.

Researchers at Threatdown, the enterprise arm of Malwarebytes, say the operators appear to work hands-on rather than blasting payloads at anything that moves. Initial access looks to come from stolen RDP credentials. Once inside, the crew manually runs a payload called servertool.exe, sets up a backdoor admin account for persistence, and uses legitimate remote management software like RemotePC to move around without standing out. In at least one incident, the RMM tool they leaned on was something the victim's own IT team had installed.

The encryption is, unfortunately, well built

The malware is written in Go. It walks directories with no depth limit, encrypts almost everything in 1 MB chunks using ChaCha20-Poly1305, verifies that each file can be decrypted before deleting the original, then wipes the key from memory and removes itself from disk. Encrypted files end up with a .prinzeugen extension. That is competent engineering, designed to be reliable for the attacker and clean up after itself.

No note, no wallpaper, no theatre

The behavioural choice is more interesting than the cryptography. There is no ransom note. No changed desktop background. No splash screen demanding bitcoin. Negotiations happen out of band, via email, phone, or a dark web portal. Two things follow from that.

• The forensic trail is thinner, because there is no obvious artefact to point an investigator at.
• Automated detection that watches for the usual ransom-note-dropping behaviour does not fire.

Threatdown notes this quieter extortion model is becoming more common among organised crews who would rather not announce themselves on the victim's screen.

A small, deliberate operation

So far Prinz Eugen has only named a handful of victims publicly. Standard Bank is among them, reportedly asked for 1 BTC and reportedly refused. The group is not running an affiliate programme, which points to a small, controlled crew rather than a sprawling franchise renting the malware out to anyone with a wallet.

The part worth paying attention to is how unexotic all of this is. The clever file-sorting trick gets the headline, but the actual access story is the boring one we keep telling. A stolen RDP credential, probably bought or phished. A persistence trick that is just a new admin account. A remote management tool the defenders already trust, because they are using it themselves. None of that needs a zero-day or a novel exploit chain.

If the freshest files on the network are the ones the business cannot function without by tomorrow morning, then the people with hands on keyboards remain the meaningful line of defence. The malware is just doing the maths the attackers were always going to do.