Prinz Eugen Ransomware Infrastructure Connections

Ankit Mehta@Secvyn

•updated Jun 23, 2026•0•0•2

This rule detects network connections to known command and control (C2) infrastructure associated with the 'Prinz Eugen' ransomware, also referred to as the ROOTBOY actor. It identifies connections to specific IP addresses and URLs that have been linked to this threat actor's operations.