Prinz Eugen ransomware: a deep dive into a new Go-based encryptor

Prinz Eugen is a newly discovered Go-based ransomware family first observed in April 2026, attributed to an actor known as ROOTBOY. The encryptor employs sophisticated techniques including ChaCha20-Poly1305 encryption, prioritizes recently modified files to maximize pressure on victims, and implements anti-forensic measures such as memory scrubbing and self-deletion. Unlike typical ransomware, it leaves no ransom note on disk, conducting all extortion communications out-of-band through leak sites and direct contact. The threat actor gains initial access through compromised RDP credentials, uses legitimate RMM tools like RemotePC for persistence, and creates backdoor admin accounts. Victims span multiple countries and sectors, with notable incidents including Standard Bank Group in South Africa and Transitions Pro Centre Val de Loire in France.

• Moonrise RAT: A New Low-Detection Threat with High-Cost ConsequencesCampaign2026-02-24
• Analysis of Encryption Structure of Yurei Ransomware Go-based BuilderMalware2025-11-14
• ZynorRAT technical analysis: Reverse engineering a novel, Turkish Go-based RATMalware2025-09-10
• Unmasked: Salat Stealer · A Deep Dive into Its Advanced Persistence Mechanisms and C2 InfrastructureMalware2025-09-06