Executive Summary
Prinz Eugen is a newly identified ransomware family written in Go, attributed to an actor known as ROOTBOY (alias avtokz). The threat actor has targeted high-profile institutions, including South Africa's Standard Bank Group, demanding payments in Bitcoin after exfiltrating massive datasets. The operation is characterized by a 'hands-on-keyboard' approach, with dwell times of approximately three weeks used for lateral movement across enterprise applications like SharePoint and Citrix.
The encryptor (servertool.exe) is notable for its deliberate file-targeting logic, which prioritizes recently modified files to maximize pressure on the victim. It employs sophisticated encryption using ChaCha20-Poly1305 and takes aggressive anti-forensic measures, including zeroing keys in memory and self-deletion via a ping-delay trick. The lack of an on-disk ransom note suggests the actor favors out-of-band communication through direct contact or dark-web leak portals.
This threat is highly relevant due to its use of legitimate Remote Monitoring and Management (RMM) tools like RemotePC for persistence and its efficient use of Living off the Land (LOTL) techniques. The actor appears to dismantle infrastructure—including C2 panels and typosquatted domains—following successful operations to further complicate attribution and forensics.